> able to take over anyone's account simply by sending them a link
dont click links people
that'll be $500k for the security training pls
If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.
We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
> We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
This has been a thing since forever lol
Security software fetching links will not trigger this behavior. It needs to be done in the context of the actual ChatGPT user so that a JavaScript payload can run.
If merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.
Yes, if it requires the user session (xss related), like the article, there is no problem.
I was replying more generally about the "don't click links" advice and cases of server generated confirmation-token links (not saying this was the case at OpenAI)
[flagged]
... says IT and then it sets Outlook to mangle link to abominations like [0]. "Check if the preview shows something different or suspicious."
[0]: https://che01.safelinks.protection.outlook.com/?url=https%3A...
I've worked at a company that did link mangling on everything except simulated phishing emails. The effect was that people were trained to trust the mangled links.
{"deleted":true,"id":50316315,"parent":50315491,"time":1793455424,"type":"comment"}
God I hate those
I wanted to check your website from your profile, but then I remembered your advice. Thanks!, dodged a potential bullet
Also many emails from tech companies today:
- "sign in via one-time code."
- "Click here to see our latest update".
"Scan this QR code!"
{"deleted":true,"id":50315450,"parent":50315181,"time":1793449179,"type":"comment"}
Thanks! Here, click on this link to get paid
[dead]