This seems like quite a big deal, and I'm quite surprised I'm not hearing more about this. These URLS are basically a free pointer into sensitive systems at the

This seems like quite a big deal, and I'm quite surprised I'm not hearing more about this. These URLS are basically a free pointer into sensitive systems at their most vulnerable state, aren't they? This technique seems to bypass every other security control and just jump, straight to account hijack. Why would the default behavior be to share URLs with all parameters publicly? Am I missing or misunderstanding something here, because this sounds insane? The security model of basically every online service depends on the absolute secrecy of full URLs in emails, right? Email is treated like root.