← Back to context

Comment by kro

1 day ago

If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.

We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

4 comments

kro

Reply
weird-eye-issue  1 day ago

> We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

This has been a thing since forever lol

dpark  1 day ago

Security software fetching links will not trigger this behavior. It needs to be done in the context of the actual ChatGPT user so that a JavaScript payload can run.

If merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.

  • kro  21 hours ago

    Yes, if it requires the user session (xss related), like the article, there is no problem.

    I was replying more generally about the "don't click links" advice and cases of server generated confirmation-token links (not saying this was the case at OpenAI)