moderated Re: Expire invitations after 14 days #suggestion


 

Jim,

I don't see how it can give access to his/her account or to the system
to anyone else. It isn't like a login link, which could do that.
The invitation email contains a link "accept the invitation" which IS effectively a login link. That is the problem that was reported, and which precipitated the shorter lifetime for the link.

While attempting to ask a question about invitations an invitee posted the text of a received invitation, including that link, on a public forum. I tested it, and it did indeed log me in to the invitee's account. I was able then to access the content of a private, restricted group of which the invitee happened to be a member (and I not).

Shal

Join main@beta.groups.io to automatically receive all group messages.