Confirm linking accounts elsewhere

[chadwhitacre]

It's possible in convoluted circumstances for attackers to trick participants into linking an account elsewhere belonging to the attacker, to the participant's Gratipay account. We should protect against this by adding an additional confirmation step, as Phabricator does:

Fix for https://hackerone.com/reports/170684.

[chadwhitacre]

We already have a confirm page for merging accounts. We want to add another confirm page before that one.

[chadwhitacre]

We have two actions, opt-in and connect. What's the difference?

[chadwhitacre]

https://github.com/gratipay/gratipay.com/blob/f556b4ff66fb4aaa462e300ed386daeef02203c9/www/on/%platform/associate.spt#L53

https://github.com/gratipay/gratipay.com/blob/f556b4ff66fb4aaa462e300ed386daeef02203c9/www/on/%platform/associate.spt#L66

[chadwhitacre]

opt-in is initial sign-in, connect is adding another account once you're already signed in. We certainly need the additional confirmation in the connect case. Do we also need it in the opt-in case?

[chadwhitacre]

Yes. Creating a new account with a malicious elsewhere attached is no better than linking a malicious elsewhere to an existing account.

[chadwhitacre]

Let's see if we can stick with ./associate as the callback to avoid having to update at all providers.

[chadwhitacre]

Closing per gratipay/inside.gratipay.com#1196.