When users change their email addresses within a web application's user account, I see the following problem:

An attacker (who has access to your session) could change your email address to a new one (the attacker's one), logout and request a "forgot my password" reset. From that point, he owns the account.

To my surprise, even major sites (from eBay to Github) allow to change the email adress without asking for passwords etc... In my understanding, this makes account takeovers via internet cafe/university/shared computers extremely easy. And I think that the guys behind eBay and Github (for example) know what they do.

Why do those sites allow email change requests without asking for a password ?

1 Answer 1


Actually, github will ask you for a password when you attempt to change your email address. However, it does not ask if you are already in sudo mode.

  • He mean, if somebody take a control over computer, when you are off for just a seconds.
    – user29357
    Aug 13, 2013 at 9:20
  • 1
    In my eyes, the problem is the user in this case. On shared computers, you should not leave still being logged into your accounts.
    – weeska
    Aug 13, 2013 at 10:58
  • Just a question, but what would prevent you from altering the password and then resetting the email address (because by now you know the pw) Nov 27, 2013 at 16:45
  • Just speculation but maybe they have a cooling off period after changing your email, where you can't do a password reset for a fixed time.
    – paj28
    Nov 27, 2013 at 22:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .