News for hackers. Stuff that matters.

A comment on Magic/tragic email links: don't make them the only option. Parent comment

Re:Magic/tragic email links: don't make them the only option by o999 on Tuesday January 07, 2025 @06:10PM (#42628847)
Not necessarily, some services would have the magic link verify the session that triggered it regardless of browser or device.

I assume it generates a session on the post-login screen and authorize that session upon accessing link

[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by ydant on Tuesday January 07, 2025 @06:45PM (#42629117)
That has the problem of opening up an attack where the attacker requests the sign-in link, the person receiving the link blindly clicks it, and the attacker now has access.

People blindly click links all the time. It would have a low success rate, but would be more than 0%.

[ Parent | on HN ]