4 ms·
> This could work because a user could say log in via oauth via another service, link their account to the unknown preexisting account by setting the same email
by mr_toad 8y ago
> This could work because a user could say log in via oauth via another service, link their account to the unknown preexisting account by setting the same email account.
For that to work the service would have to allow a login with email/password without verification, and then also allow oauth login to the same account.
- michaelmrose 8y agoThey obviously allow account creation without verifying that user controls the email address in the first place so the second isn't much of a stretch. They are grossly incompetent.