> able to take over anyone's account simply by sending them a link

dont click links people

that'll be $500k for the security training pls

If they or their company use email "security" software that "scans" all links it's not necessarily the users fault / they don't in fact click. The mail is auto-confirmed the second it hits the inbox.

We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.

... says IT and then it sets Outlook to mangle link to abominations like [0]. "Check if the preview shows something different or suspicious."

[0]: https://che01.safelinks.protection.outlook.com/?url=https%3A...

I wanted to check your website from your profile, but then I remembered your advice. Thanks!, dodged a potential bullet

Also many emails from tech companies today:

- "sign in via one-time code."

- "Click here to see our latest update".

Thanks! Here, click on this link to get paid

[dead]