Hacker News Reader

Comment by jareklupinski | Hacker News Reader

> able to take over anyone's account simply by sending them a link

dont click links people

that'll be $500k for the security training pls

If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.

We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

> We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

This has been a thing since forever lol

Security software fetching links will not trigger this behavior. It needs to be done in the context of the actual ChatGPT user so that a JavaScript payload can run.

If merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.

Yes, if it requires the user session (xss related), like the article, there is no problem.

I was replying more generally about the "don't click links" advice and cases of server generated confirmation-token links (not saying this was the case at OpenAI)

I wanted to check your website from your profile, but then I remembered your advice. Thanks!, dodged a potential bullet

Also many emails from tech companies today:

- "sign in via one-time code."

- "Click here to see our latest update".

dont click links

250k refresher fee

hey, don't dump the market

Click this link to be told not to click links.

"Scan this QR code!"

... says IT and then it sets Outlook to mangle link to abominations like [0]. "Check if the preview shows something different or suspicious."

[0]: [redacted]

I've worked at a company that did link mangling on everything except simulated phishing emails. The effect was that people were trained to trust the mangled links.

God I hate those

Thanks! Here, click on this link to get paid

Reply on news.ycombinator.com