On Tue, Jan 4, 2022 at 06:07 PM, Glenn Glazer wrote:
I would assume that if someone forwarded such a link
to someone not in the group the link referenced, that the latter
person's clicking on the link would not cause any changes to the
group and just take them to an error or home page. Correct?
You could assume that, but that's not the way it works with the
existing unsubscribe link. Anyone with the link can unsubscribe
you.
Oh no. Thanks for correcting me... that's not optimal and I begin to
understand the concerns others have.
My own preference would be to somehow divorce the voting function
from the login function. Such a "vote now" link (or whatever we're
calling it) would identify which member you are, and take you to a
place where you can vote, but not actually log you in (i.e.: so
you can't do any further damage).
Not a trivial exercise.
Regards,
Bruce
I think MFA is the solution to these problems. If the link holder
can't respond correctly with the second auth form, then they aren't
that person and no harm can be done.
