magic link, no expiration, and sent to the wrong email? depending on the entropy of the magic link generator, it would be possible to do whole-site takeover, not just a single account takeover

and my car has a strange, roaring noise coming from the front right wheel... got to a mechanic, he said it sounded like a dying transmission and he wasn't a specialist. he referred me to another one, and I was glad the first one wasn't a specialist, because the transmission is fine. It was an engine support piece, not cheap but way less expensive than a transmission.

was the first thought, and wasn't a bearing... he got the car on a jack, and said the noise was from the engine bay, not the wheels, so it could be a transmission

one of the engine support pieces (that I don't know the English name for) was broken in two, that caused a lot of vibration and a lot of noise

15 USD for 1h of work plus a 100 USD part, and solved the issue

cushion... engine support cushion

thinking of that, the word in Portuguese sound exact like someone that only speaks Portuguese tried to read cushion

So, the email's URL parameters boil down to my email and this string: 2170e9959d30fe730741d42318cef72a8b04d278

without the string, I'm met with the login page (yay!) with it, I am automatically logged in.

note that this URL was sent to me 2 days ago, so I suspect it doesn't expire

just like the site's sessions

That looks like SHA1

Crackstation didn't crack it, so it's not a common string

all in all, a very adventurous unsubscribe click!

I half expect that that string might work for any valid account ...

@schroeder could you make your own account for testing? What do you think the hash-string is in plain text?

@security_paranoid one HOPES it's s unique token

One hopes it’s a unique token for sake of the company!

@schroeder as a CISO yourself, does it appal you?

ItS appaling on so many levels. My job title notwithstanding

Oh huh, this place is kinda alive again...

So, uh, did SE improve by any chance in the past year or so, or is it just the same dumpster fires as ever?

Yes

@nobody I think it just hit the critical mass of people talking all on its own

@ThoriumBR mount