Hacker News new | ask | show | jobs
by pagecalm 79 days ago
Honestly just don't send anything past the verification email until the address is confirmed. A lot of the other fixes here are working around what's really just auth libraries trusting the address on signup. Feels like that's the thing worth fixing first.