Hacker News Reader

I like the idea but instead of mailto which I find annoying why not simply ask the user to send us an email with a hello message? The email address we provide can be unique per sign up if required.

So no copy pasting of codes, or having a specific format of the email. We just need to check the sender and recipient.

View on HN

Without a code, there is a pretty high risk of an attacker social engineering an account holder into sending an email.

I haven't really thought this through (what an attacker would gain), just want to point out the general risk.

But the code is already part of generated email, the one that the user needs to send hello to.

Ah, I think I misunderstood your proposal.

Do you want to put the code into the recipient email address?

Reply on news.ycombinator.com