3 ms·

I agree no one is saying that. I think they are being unsound in refusing to say that but also saying that URLs don't count as an authentication system. Is the

by geofft 5y ago

I agree no one is saying that. I think they are being unsound in refusing to say that but also saying that URLs don't count as an authentication system. Is the argument "Information in an email should be treated as public"? Then how do you validate users on signup in the first place? How do you ensure that someone owns an email address that they claim to own? Is the argument "Information sent over HTTPS should be treated as public"? Then why does the argument not apply to passwords or cookies? If the argument is something else, what is it?

pwdisswordfish0 5y ago
"Is the argument [...]? Is the argument [...]? If the argument is something else, what is it?" This not difficult at all. Playing dumb isn't clever, it's just obnoxious. The argument, stated amply before, is that URLs are not private. Email being a private medium or not is orthogonal.