9 ms·
Using a delegated email address to sign up for things sounds like the vulnerability then, not Facebook's handling of it.
by wycy 8y ago
Using a delegated email address to sign up for things sounds like the vulnerability then, not Facebook's handling of it.
- Alex3917 8y agoThat scenario obviously wouldn't be Facebook's fault, because any email address you sign up with is always going to be your primary email address unless you change it later. What I'm talking about is signing up with a non-delegated email address, and then adding a secondary email address for the purpose of either displaying publicly on my profile or so that my friends can find me via email in search. In other words, cases where I had no intention of ever allowing a password reset request to be sent there, knew fully well that it wouldn't be safe, but did so anyway because Facebook provided zero indication that they would do this and it's not at all intuitive that they would.