<blockquote><font size=1>In reply to:</font><hr>
Even if they do subscribe with a real email address, that can be quickly changed in the profile, and I don't recall seeing anything that tracks the original email address signed up with
[/quote]
Actually, the original email address is kept in the U_RegEmail field in the database, but this doesn't really help if that email address is on hotmail, etc.
For what it's worth, I think it's good that Dredd is bringing these points up (paranoid or not) since it is causing people to think hard about the issues and making them aware of the dangers if they decide to use such a feature. It's easy to say "nobody is going to bother writing a perl script which fakes the referrer and sends the cookie and..." but if it is possible to do it, there is a risk that one jerk will spend the time doing it and then post the script somewhere. Then anyone (even with no technical skills) would be able to exploit a huge number of W3T sites using the feature. Something that seems highly unlikely could get ugly very fast.
Bill Dimm, <A HREF="http://MagPortal.com/" target="_new">MagPortal.com</A> - <font color=red>free</font color=red> feeds for your site.
