3 ms·
A word of caution about OK cupid. The emails they send out for your QUIVER MATCHES actually have your login credentials embedded in the URL. Meaning, if you rig
by durpleDrank 14y ago
A word of caution about OK cupid. The emails they send out for your QUIVER MATCHES actually have your login credentials embedded in the URL. Meaning, if you right click, copy link address, and send the url to your friend, THEY ARE NOW LOGGED INTO YOUR ACCOUNT.
I learned the hardway, I pasted one of these links into an 80+ chat room full of 4chan rejects on IRC.
- Leon 14y agoLogin credentials or an authentication token? It's pretty standard to use an auth token in situations such as emails to protected content, considering that users profiles are blocked to non-members. To allow you to do a follow through from an email link it is necessary to introduce a way to automatically log yourself in through a click. You'll see the same email behavior from most websites you have an account for and you've allowed to send you emails. The trust chain that this is generally considered OK is that the email has gone through a two way verification for that account you've signed up for, so a uniquely generated auth token emailed is akin to a forget password at that point. The security failure was mostly on your part, but also on the sites for not conveying a notice that email links that automatically authenticate you are in emails. Sharing any directly copied link information from an email to a set of anonymous users, especially as unreputable as you have stated, is unadvised.
- ios84dev 14y agoAssuming they haven't updated it since I was there, its an auth token that expires after a specific amount of time (I want to say 2 weeks but its been a long time)