4 ms·
I'm trying to understand the implications here. Is the author suggesting that real world attack would involve randomly generating email addresses to see if they
by seanalltogether 9y ago
I'm trying to understand the implications here. Is the author suggesting that real world attack would involve randomly generating email addresses to see if they are valid or not based on whether they might match the current user. Or would the attack involve purchasing a list known email addresses from spammers, and then doing lookup against that list for every visitor that comes to your website?
Option 1 seems like it would take impossibly long to match, and I'm not sure what actionable information you get from option 2, other then maybe verifying that the email address is still active?
- TomAnthony 9y agoI didn't necessarily have a specific attack in mind when I looked for the issue. However, the way I would use it is any scenario where I want to either find out more information about a certain list of people, or where I want to alter the content I show to specfic people. It is a pretty specific attack vector, but a verifiable identification could be high impact in those few cases, and it would also be trivial to fix it.
- stevep98 9y agoWhat about if I sent a proposal with my website to a bunch of investors that I know, and I want to see which ones clicked on it.
- Viper007Bond 9y agoYou could also just use unique URLs (tracking, etc.).