3 ms·

> "I verify this is me" button even if they are on the other side of earth, so one fumble with your phone and you grant some random person access to your accoun

> "I verify this is me" button even if they are on the other side of earth, so one fumble with your phone and you grant some random person access to your account, and if these people send you 10 messages a day This isn't that far outside the norm, and assuming I understand correctly that this verification button is in the email itself, I assume it is itself a verification link. Still, taken together with everything (especially an undisclosed leak) it's enough that I've deleted my payment methods from Booking.com along with some additional personal info and probably won't be re-storing them short of the kind of retrospective reassurance that most management apparently finds beyond their capability. Without a payment method to abuse or even further data to harvest, it's hard to imagine an attacker having incentive to engage the account.

megadal 2y ago
> This isn't that far outside the norm This is pretty far out of my norm. Where I'm from email auth is referred to as OTP, as we all always assume an OTP is sent to the users email. The only time I've seen links for confirming in email are when signing up or resetting a password (or changing/verifying emails in an otherwise already authenticated context). Not for logging directly into an authenticated context. Disclaimer: I'm the type of dev who has routinely argued against magic links. The convenience they provide is hardly worth all the considerations that have to be made. I've only ever seen magic links recommended by sales people. Presumably because it makes their demos go smoother when people want to know how difficult it is to access the product.