4 ms·
Not using an email address will effectively ensure the person can never recover their account.
by rstupek 8y ago
Not using an email address will effectively ensure the person can never recover their account.
- BonesJustice 8y agoYou could also use a hash of the email so that you don't retain and can't reconstruct the original address. Then the recovery process can look for a valid account based on the provided email's hash, and if one is found, a recovery email can be sent to the provided address. Include an expiring, one-time-use token in the recovery link so you can immediately forget the address again.