Hacker News Reader

You can verify validity of an email like that, no issue there. Just don't use that as a factor authentication. Control over an email account should not trump passwords (what you know) or proper 2fa (what you have, typically, email can be 2fa like sms and like sms it is not a good choice). If a person proves they control an email account then you ask them for additional info like secret questions or other information configured during registration.

I should not be able to take over your life because I compromised your phone which has sms, TOTP app and email.

a confirmation code?

Also, mail might not live on the same computer.

It doesn't matter if it's on the same computer. Sometimes all you need to do is click the link, not do anything on the page.

options include:

* use an interstitial page so that the actual activation is a POST request;

* send a confirmation code instead of a link