If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.
replyWe've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
> We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
replyThis has been a thing since forever lol
Security software fetching links will not trigger this behavior. It needs to be done in the context of the actual ChatGPT user so that a JavaScript payload can run.
replyIf merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.
Yes, if it requires the user session (xss related), like the article, there is no problem.
replyI was replying more generally about the "don't click links" advice and cases of server generated confirmation-token links (not saying this was the case at OpenAI)
[flagged]
reply... says IT and then it sets Outlook to mangle link to abominations like [0]. "Check if the preview shows something different or suspicious."
reply[0]: https://che01.safelinks.protection.outlook.com/?url=https%3A...
I've worked at a company that did link mangling on everything except simulated phishing emails. The effect was that people were trained to trust the mangled links.
replydeleted
replyGod I hate those
replyI wanted to check your website from your profile, but then I remembered your advice. Thanks!, dodged a potential bullet
replyAlso many emails from tech companies today:
reply- "sign in via one-time code."
- "Click here to see our latest update".
dont click links
reply250k refresher fee
Click this link to be told not to click links.
replyhey, don't dump the market
reply"Scan this QR code!"
replydeleted
replyThanks! Here, click on this link to get paid
reply[dead]
reply