HYIP-Man: Tell HN: Forwarded Facebook emails automatically login as recipient
Tuesday, October 09, 2018
Tell HN: Forwarded Facebook emails automatically login as recipient
Tell HN: Forwarded Facebook emails automatically login as recipient
I'm rarely speechless, but my best friend - who is not a developer but tech-savvy - just forwarded an email invite to an event that she wants me to come to with her. The email was a standard transactional Facebook event notification. When I clicked on the event, I was logged into Facebook as my friend. Full privileges. I could have done anything. I logged out, called her immediately and explained that a) she shouldn't send anyone transactional emails from Facebook and b) that in my opinion, she hadn't done anything wrong. This is an outrageous security violation, as well as a violation of the principle of least surprise. It seems completely reasonable to me that someone would forward an event invitation to other people. I see this kind of thing with older folks, in particular. The obvious concern, here, is that someone could (not should) forward that email to a much larger group of people. In an era where people are unfortunately reliant on Facebook for their identity management, social connections and even professional networking, the idea of losing access to your Facebook profile to an unknown actor is terrifying. I don't understand how this ever made it past QA. If you work at Facebook, fix this right now.
more
Written at 2:57 AM by Frank.
0 comments