If your app uses Firebase Auth email verification, enterprise Outlook users protected by Microsoft Defender Safe Links may already be getting their accounts auto-verified — without them ever opening an email. That flip of emailVerified = true can silently enable attackers to impersonate employees, trigger payouts, reset credentials, or walk through internal onboarding flows. This is a huge trust collapse between two widely used security features.
Comments URL: https://news.ycombinator.com/item?id=45728529
Points: 1
# Comments: 1
Source: news.ycombinator.com
