← Back to context

Comment by jareklupinski

1 day ago

> able to take over anyone's account simply by sending them a link

dont click links people

that'll be $500k for the security training pls

18 comments

jareklupinski

Reply
kro  1 day ago

If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.

We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

  • weird-eye-issue  21 hours ago

    > We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

    This has been a thing since forever lol

  • dpark  20 hours ago

    Security software fetching links will not trigger this behavior. It needs to be done in the context of the actual ChatGPT user so that a JavaScript payload can run.

    If merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.

    • kro  19 hours ago

      Yes, if it requires the user session (xss related), like the article, there is no problem.

      I was replying more generally about the "don't click links" advice and cases of server generated confirmation-token links (not saying this was the case at OpenAI)

dist-epoch  1 day ago

I wanted to check your website from your profile, but then I remembered your advice. Thanks!, dodged a potential bullet