Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When users change their email addresses within a web application's user account, I see the following problem:

An attacker (who has access to your session) could change your email address to a new one (the attacker's one), logout and request a "forgot my password" reset. From that point, he owns the account.

To my surprise, even major sites (from eBay to Github) allow to change the email adress without asking for passwords etc... In my understanding, this makes account takeovers via internet cafe/university/shared computers extremely easy. And I think that the guys behind eBay and Github (for example) know what they do.

Why do those sites allow email change requests without asking for a password ?

share|improve this question

1 Answer 1

Actually, github will ask you for a password when you attempt to change your email address. However, it does not ask if you are already in sudo mode.

share|improve this answer
    
He mean, if somebody take a control over computer, when you are off for just a seconds. –  user29357 Aug 13 '13 at 9:20
1  
In my eyes, the problem is the user in this case. On shared computers, you should not leave still being logged into your accounts. –  weeska Aug 13 '13 at 10:58
    
Just a question, but what would prevent you from altering the password and then resetting the email address (because by now you know the pw) –  Lucas Kauffman Nov 27 '13 at 16:45
    
Just speculation but maybe they have a cooling off period after changing your email, where you can't do a password reset for a fixed time. –  paj28 Nov 27 '13 at 22:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.