81–90 of 271 posts
Earlier quoted context omitted.
Btw you could just have JS do a POST request, the user doesn't need to do anything except open the page. This is how unsubscribe pages work.
That presumes everyone executes random JS or has a browser that supports it.
I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…
We solved it by having a screen with a confirmation button , then later we added javascript to show a loader page over the button and click the button automatically.
Earlier quoted context omitted.
True. Phish testing campaigns in companies that send fake phishing emails to employees, are probably full of inaccurate data due to this. "Why did you click that link? But, I didn't."
Many phishing test as a service companies will report clicks vs. people who actually interact with the page.
I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…
Earlier quoted context omitted.
And make sure the action is a POST instead of a GET. GETs should never modify important state.
This is the correct answer. Just because the norm is to embed verification hashes in URLs to be clicked, doesn't mean it's the right way for it to be done. Why not send a short random code by email for the user to then copy into the sign-up form they were in the process of filling in?
Earlier quoted context omitted.
And make sure the action is a POST instead of a GET. GETs should never modify important state.
This is the correct answer. Just because the norm is to embed verification hashes in URLs to be clicked, doesn't mean it's the right way for it to be done. Why not send a short random code by email for the user to then copy into the sign-up form they were in the process of filling in?
All of that may affect the sign-up rate.
I always wondered when single-click unsubscribe was going to be a problem because of exactly this. I mean, how do you expect to give a URL to Google and have them just never crawl it?
You make just visiting the URL not everything that needs to be done. So for example, the URL you visit then also runs a small bit of javascript behind the scenes that does the actual unsub action - or the javascript just does a redirect. Or even simpler, you make it so the user has to click a button to POST the request. You've had to do this for years, now. I would assume though, that Gmail is smart enough to go, "oh…
You visit a URL, and some JS POSTs to `https://[youraccount].us1.list-manage.com/unsubscribe/post` with a body containing your subscription and list IDs.
I'm not sure what prevents crawlers executing JavaScript on that page and triggering the unsubscribe action anyway, though, unless it's just that email crawlers don't execute JS.
Earlier quoted context omitted.
This is the correct answer. Just because the norm is to embed verification hashes in URLs to be clicked, doesn't mean it's the right way for it to be done. Why not send a short random code by email for the user to then copy into the sign-up form they were in the process of filling in?
It takes more effort and more users will decide to move elsewhere. I don't really believe that if someone can't bother to copy code from e-mail, he's worthy to have as a client, but some company are obsessed by metrics and percentage of successfully registered users is one of those metrics.
Earlier quoted context omitted.
Btw you could just have JS do a POST request, the user doesn't need to do anything except open the page. This is how unsubscribe pages work.
That presumes everyone executes random JS or has a browser that supports it.