5 ms·
A few years ago I noticed an uptick in services sending out "magic links" that take you direct to their service, already signed in. I've always thought there ha
by SteveNuts 8y ago
A few years ago I noticed an uptick in services sending out "magic links" that take you direct to their service, already signed in. I've always thought there has to be some sort of vulnerability in that, perhaps this is it?
- ggggtez 8y agoThe fact that netflix lets you create an account without verifying you actually own the email address they are sending the token to is the real bug. Besides, even without a magic link, they could still phish you into clicking a link to a malicious page that performed a login-csrf which would have the same effect.
- chrisweekly 8y agoSee eg auth0's passwordless login via email. Given standard password flows include email-based password reset, there's really no difference in security; either way, if someone owns your email, you're screwed. TFA does help mitigate this though.