tagged.com emails auto-login

I just signed up for tagged.com because I heard about something strange...

Apparently - they send email notifications with tokens in the URL that authenticate you automatically to their site after clicking...

I was wondering what kind of vulnerabilities would exist with this... For instance if my email account is ever used by anyone else again, they would receive these emails that let them into my account.

At the same time though, password reset emails would get them in all the same.

Does anyone else see this as a problem? It seems fishy... :drink:

Quote:

---

Originally Posted by d34dl0k1

I just signed up for tagged.com because I heard about something strange...

---

Just a word to the wise, tagged doesn't have the best of reputations. Quite a lot of profiles are fake.

Quote:

---

Apparently - they send email notifications with tokens in the URL that authenticate you automatically to their site after clicking...

---

That's correct. They're not the only social network site that does this btw.

Quote:

---

I was wondering what kind of vulnerabilities would exist with this... For instance if my email account is ever used by anyone else again, they would receive these emails that let them into my account.

---

Correct. You also need to be careful when forwarding said emails. It will contain a link anyone can use to login on your account.

Quote:

---

Does anyone else see this as a problem? It seems fishy... :drink:

---

As I said, I've seen more sites do the exact same thing. Just be careful were you leave those emails.

You might find these links interesting?

http://www.consumerfraudreporting.or...ed_dot_com.php

http://foolswisdom.com/tagged-com-sp...ing-nice-guys/

http://spamnews.com/The-News/Latest/...2009073111567/

;)

Quote:

---

http://www.consumerfraudreporting.or...ed_dot_com.php

---

Darn somepeople have waaay to much time on there hands.

Reminds me of the 4 or so people suing FaceBook because they are to popular now.

Quote:

---

One plaintiff is an 11-year-old boy who joined Facebook and then posted that he had swine flu and uploaded pictures or video of "partially-clothed" children swimming, according to the lawsuit.

---

Did people not catch the slight references to memes in that paragraph?

Edit: How much do you want to bet that the pool is closed due to swine flu?

Quote:

---

Originally Posted by The-Spec

Did people not catch the slight references to memes in that paragraph?

Edit: How much do you want to bet that the pool is closed due to swine flu?

---

My gosh, they were "partially clothed":shocked: You mean their parents didn't make them wear those full-body bathing suits that were popular in the 1800's? What's this world coming too....... :shocked:

Obviously the 11-year old's suit was written by his parents, or by a lawyer hoping to win on the anti-child-pornography wagon. Understand that I'm totally against child-porn as I have kids, but "partially clothed" at a swimming pool??? They need a life.

Have a great day:)
Patrick.

Hello Patrick,

Quote:

---

My gosh, they were "partially clothed"

---

ah! but it doesn't say which part? :D

Quote:

---

Obviously the 11-year old's suit was written by his parents

---

Who I would now have reported to the Social Welfare..........the parents let him run feral on the interwebz?

56 days in Colchester Military Corrective Training Centre............he will come out as something useful for Iraq/Afghanistan, or a vegetable ;)