On: Booking.com ignores twofactor, lets everyone email-login without a password

[withinboredom]

You can go to youtube and login with any random email address and get the full name of the person and profile photo, assuming they've ever logged into Google. All you need is their email address.

[nighthawk454 → withinboredom]

Is this still true after the recent signin page updates? I tried it and didn't seem to get those

[withinboredom → nighthawk454]

Ah, looks like it is tied to "has this IP ever logged in with this email" kinda thing.