3 ms·
Ask HN: Is it okay that email change doesn't require my password?
On HN, changing my password requires me to type in my existing password. This makes sense: it prevents someone with my session from stealing my account.
However, there doesn't seem to be anything preventing someone from changing my email and submitting a password change request. It seems like a lot of websites allow this.
- chris_va 11y agoExamples? You'd be suprised how adhoc site security can be, even for popular websites. Since changing the email effectively does allow you to change the password, it is not a bad observation.