Epic Evernote Mailing List

    I noticed this post here and also remembered one epic mailing list, this time from Evernote. Each newsletter has a link “Opt out of this newsletter”.

    Great feature, you can’t argue. It just looks like this link like this:
    And what is surprising and terrible - the “M” field is the user ID and clicking on this link we get a page of the form “Do you really want to unsubscribe?”, On which the real mail of this user will be indicated. There are no keys, hashes or anything else in the link. As a result, changing the number in the “M” field, we can easily iterate from zero to “how many will fit” and get the database of Evernote user mail addresses. This is such confidentiality.

    Also popular now: