Note: This is based on a true story!
Alice and Bob are good friends and each one knows the personal email address of the other person and they contact with each other using it. Let's assume they are
email@example.com for Bob and Alice, respectively.
Bob is a member of an online community (i.e. such as a forum) and he has put another email address of him, say
firstname.lastname@example.org, on his profile so that other users can contact him using it (that online community does not have a built-in message system for the users to contact with each other). Further, Bob has setup
email@example.com as the recovery email address of
firstname.lastname@example.org. And he has not (intentionally) put any other personal information on his profile that says this account belongs to Bob.
Alice knows that Bob is a member of this online community, however she doesn't know which account belongs to Bob. She suspects that this profile with the email address
email@example.com on it belongs to Bob, but she is not sure of it. In order to confirm her suspicion, she comes up with this plan:
She goes to Gmail website, enter
firstname.lastname@example.org as the email address and presses
Forgot password? button. Then the following message is shown:
To get a verification code, first confirm the recovery email address you added to your account: "email@example.com"
firstname.lastname@example.org and then the following message is shown:
Please enter the verification code sent to
That's it! She finds out that the account and email address belongs to Bob. She gets very excited and sends the following message to
email@example.com as a result:
Ha ha! EXPOSED!
Well, Bob is very furious at this. He argues that he has followed all the security guidelines and he has tried hard to not expose any of his personal information and identity. Rather, he blames email provider (i.e. Gmail) and says that they should have designed the account recovery mechanism such that it protects the identity of the person behind the email address.
On the other hand, Alice, at the same time being proud of her ingenious plan, thinks that in this case there is an inevitable trade-off between convenience and security. She says that Bob has setup the recovery email so that he does not worry about his password being forgotten by him, and in turn this has the side effect of revealing his identity.
Who is right here? If you think Bob is wrong, what should have he done to both secure his identity and his email (i.e. keep it recoverable)? And if you are on Bob's side and think it is the email provider's fault, how should have they implemented the recovery mechanism?
Further, note that I am not insisting that only one of the parties is right and the blame is on the other side. It might be that both parties are wrong or right as well. If you have other viewpoints, I would be glad to hear them.