Consider the following strawman application, which remembers your TODOs.
- Application has a destination email "email@example.com"
- Users (already registered through normal means) send emails to the above domain, expecting their TODOs to be saved
- The application, upon receiving the message, stores its content.
Later, auser visits todosaver.com, logs in, and retrieves this content.
This worries me because you can spoof the email source address (e.g., Alice sends firstname.lastname@example.org and email faked as from email@example.com containing malicious content).
In this case, I would imagine that an approach that both:
- sanitizes the email content
- displays the escaped text only
is probably sufficient, but am worried about this general approach now where (1) an email is verified by sending the user and email and (2) from then on, emails from that user are used for identity in this way. It feels like there should be a better way to do this (for instance, the above approach still lets malicious actors post spam to user's webpages).
What are established approaches to establishing identity through email, and what are their security/usability tradeoffs?