I am not referring to any specific site in this question . If a site allows users to change email after login can't a hacker by obtaining user password due to users negligence then change email and then change username and password to gain full access ?

  • Yes, this is possible. A password compromise can lead to serious problems like this, i.e. fully loosing access to the account. – Steffen Ullrich Feb 8 at 17:37

Everything is dangerous, including breathing and eating. It's all a question of balancing the risks.

You are looking at a case where the username and password of an account got compromised. At this point the attacker has full access to the account. What you are now looking at is what recourse a legitimate user has. How can they reclaim access to their account?

Emails are historically used as a reasonable stop-gap. If you have access to an email account, you're probably the intended owner of the account. It is nice because it is automated. However, if push comes to shove, and you really need to get an account back, the last line of defense is always to contact the company and talk to a real live person.

On the other hand, the need to be able to update credentials is very important. Many of us nowdays keep an email account from cradle to grave, but it wasn't always that way. Many people still use an email address provided by their ISP. If you couldn't change the email address associated with an account, you would be forever bound to an ISP -- quite the conundrum if you were to move to a new state with different ISPs!

So the decision is that the rewards outweigh the risk. Maintaining a solution for all customers using a service, even as they have to update their contact information, proves more important than the risk of a hacker using this to steal an account away.

  • As a personal reference, I have once lost my credentials to an account so completely that I could not log in nor reset my password. When I called up customer service, I was directed to go to a local branch office with a government issued ID, and they would reset my account there. It was not a fun experience, but it was indeed a working way for me to get back to owning my own account! – Cort Ammon Feb 8 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.