Is there a point in sending a confirmation mail to the old address? I see two points there

  • If your account is taken over, a confirmation mail to the old address with an undo link would revert the take over.
  • If your e-mail address is taken over, you cannot change the mail address on the service as the attacker can cancel the request.

The first point would be a big benefit for the security on the service. The problem is, that the second point makes the life for someone with a hacked e-mail account even harder.

  • MFA (Mutli-factor authentication) is a better way to approach such issue. It create second layer of security (although it doesn't mean it is 100% bullet proof) – mootmoot Dec 22 '17 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.