The implications depend on your app. If the user doesn&#x27;t notice being logged into a new account, they may go on to create data in the attacker&#x27;s account that they expect to be private (e.g. YouTube watch history).<p>On e-commerce sites, they might add a credit card - thereby allowing the attacker to use it.<p>Fortunately, HN doesn&#x27;t have these risks, but it&#x27;s a good illustration of how CSRF works in the real world.