“Magic links” can end up in Bing search results, rendering them useless

Re:“Magic links” can end up in Bing search results, renderin... by dTal on Monday June 27, 2022 @09:43AM (#31894505)

>We ended up adding a custom page to handle e-mail validation so we could handle the situation where the user lands on the page and the address has already been verified.

That's a yikes from me! So I can sign up on your service as anyone with an Outlook account, without verification?

[ Parent | on HN ]

Re:“Magic links” can end up in Bing search results, renderin... by kevin_thibedeau on Monday June 27, 2022 @12:17PM (#31896730)

Facebook has allowed this in the past and someone recently opened an unverified Instagram account with my address.

[ Parent | on HN ]

Re:“Magic links” can end up in Bing search results, renderin... by colejohnson66 on Monday June 27, 2022 @10:05AM (#31894762)

I'd assume the custom page has a random URL and requires entering the email address (requiring a match) or clicking a button. I've seen some account confirmation pages like that.

[ Parent | on HN ]

Re:“Magic links” can end up in Bing search results, renderin... by nieve on Tuesday June 28, 2022 @01:18AM (#31904369)

Discord let someone sign up with my gmail email address, sent an email verification link, and before I saw either the "welcome to Discord" or "please verify your email" links they'd already let the person in as me. I don't know if this is because of google crawling links from mail or some other kind of failure, but I wasn't pleased that Discord would let someone impersonate me.

[ Parent | on HN ]

Re:“Magic links” can end up in Bing search results, renderin... by sandermvanvliet on Thursday June 30, 2022 @08:54AM (#31931771)

No it would still require username/password. This was only verifying the email address was correct.

[ Parent | on HN ]