Timeline for What is the suggested best practice for changing a user's email address?
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 4, 2021 at 12:48 | comment | added | PirateApp | how will do you do this if the user used a social login like facebook to signup without a password? | |
| Jul 29, 2020 at 10:20 | comment | added | Mike Poole | Another issue to consider when talking about reassignment of email addresses is that a user might no longer own their previous domain name because they allowed it to expire. This allows an actor to register the domain and create the mailbox. | |
| Jul 12, 2020 at 11:04 | vote | accept | Marv | ||
| Jul 4, 2020 at 16:53 | comment | added | Vilx- | My own first mail account at a provider that does not exist anymore. All their mailboxes were deleted. They did notify everyone and give a good long time for backing stuff up though. But it does happen time to time. | |
| Jul 4, 2020 at 7:31 | comment | added | Esa Jokinen |
Requiring confirmation through both old and new mail is pretty common with domain registrars. A problem arises when an account is created automatically during domain transfer with an email address that's not in use anymore. Such might happen if the email provider ceases to exists or if one has used a work email and switched employer... Some of these cases ended with the registrar requiring a signed form & a copy of owner's passport as a "proof of identity" via fax, in 2020! IMO, the 5xx could be considered as a proof of non-existence of the old email, skipping the check.
|
|
| Jul 3, 2020 at 7:08 | comment | added | jmoreno | @csiz: I’ve spent the better part of a decade trying to get back into an email account, which uses security questions to authenticate. By the way, if what’s up is the sky, what’s down? | |
| Jul 2, 2020 at 22:47 | comment | added | alephzero | @csiz. Personal experience: Email address from a mainstream ISP which was taken over by another ISP, retaining the original email addresses. The service from the second ISP was **** so I signed up to a third ISP. I can't contact the first ISP (which doesn't exist) and the only way to get through the second ISP's auto phone answering system is transfer my landline phone contract to them (but it now is provided by the third ISP). The original email address is presumably still functional, but I have no way to access it. | |
| Jul 2, 2020 at 18:32 | comment | added | barbecue | @csiz Reassignment of emails happens all the time, especially in corporate environments. And speaking from personal experience, I can assure you that some addresses do become completely inaccessible. It's happened to me several times. | |
| Jul 2, 2020 at 15:26 | comment | added | csiz | That's true, but when someone uses a disposable email, presumably they don't invest much in the service they signed up for either. It'd be a shame to sacrifice security for them. | |
| Jul 2, 2020 at 15:09 | comment | added | reed | @csiz, I'm pretty sure I've seen some free email providers that, after an expiration time, might reassign the address. For example, I just quickly checked mail.com ToS, and I found this: "[...] your e-mail address may be released and made available to another customer." Also, I was thinking of those situations when you drop a domain, and your old [email protected] might then belong to the new owner of the domain. | |
| Jul 2, 2020 at 14:49 | comment | added | csiz | I've got to disagree with your premise, email addresses are not like phone numbers and they're really unlikely to be re-assigned or completely inaccessible. Thus I'd trust the old email with all the information required to recover the account for quite a long time. If the old address falls back to the organisation's care they already have access to all previous emails received. The most likely issue is an attacker changing the email to gain control of the account, in which case just password verification isn't enough, so I'd go with @Trickycm's answer. | |
| Jul 1, 2020 at 16:46 | history | answered | reed | CC BY-SA 4.0 |