alt Hacker NewsIf they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.
We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
Replies
dpark • today at 2:37 PM
Security software fetching links will not trigger this behavior. It needs to be done in the context of the actual ChatGPT user so that a JavaScript payload can run.
If merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.
➕ show 1 reply
gokulravi992 • today at 12:38 PM
[flagged]
> We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
This has been a thing since forever lol