5 ms·

I don't understand, it just never prompted you for a password?

SketchySeaBeast 7y ago
Nope. I was using the built in Android Account linking (like if you link up your Facebook account to an application OAuth style), but the person who set up the account couldn't have been - they would have set it up with a password as they can't access my email account. Of note here, I never verified the account when the user first signed up, so DoorDash has always just been going on the first guy's word that they are who they say they are.
- deleted 7y ago
  [deleted]
- gtCameron 7y ago
  If you control the email address on the account you could get in by resetting the password, so I'm not sure what the difference is there
  - deleted 7y ago
    [deleted]
  - SketchySeaBeast 7y ago
    To me the difference is the intent - I didn't intend on entering someone else's account. If I'd tried to log in with a password/email, it would have told me the account already exists, or prompted me to reset the password, and then I'd need to request that and knowingly invade the account. This way I just walked right in without even knowing what I was doing - I didn't realize there was even a problem until I went "hey, that's not my phone number!".
- enjo 7y ago
  I don’t see the issue? DoorDash authenticated that you own the email account via a trusted third party. Once authenticated they authorized you to use the account associated with that email address. It’d be like someone else booking a hotel room as you. When you show up at the front desk they verify it’s you and then let you into that room because it is after all... yours.
  - SketchySeaBeast 7y ago
    I suppose so. I guess we assume that email ownership is digital ownership - even though they never verified that the user in fact owned the email? I wonder how that legally works - was I in the wrong for unwittingly accessing someone else's information?
  - l8again 7y ago
    Actually, it's more like someone else booked a hotel room as OP. Since they were there in person, the hotel gave them the room key, and they are in that room taking a shower (updated the phone number in this case). The OP goes in and asks for a room, presents his/her email, and since it matched receives the key to the _same room_. OP then walks into the other guy's room while they are in it. At least that's my understanding of it. edit: grammar
    - dylan604 7y ago
      maybe if you said you lost your key, but if you come in and ask to check-in, the clerk isn't just going to hand you a new key. they're going to say, but mr. soandso, you're already checked-in.
- paxys 7y ago
  Lots of services out there let you log in using both password or an external provider (Google, Facebook etc.)
  - SketchySeaBeast 7y ago
    I guess I've never experienced a service where it lets you log in with either option on the same account. At least it should have you verify the email account before assuming that the information is valid.
- ahmedalsudani 7y ago
  Yeah this is why you do email verification. But you gotta move fast and break things ¯\_(ツ)_/¯ Or whatever the hip phrase is now that FB is radioactive.

Nope. I was using the built in Android Account linking (like if you link up your Facebook account to an application OAuth style), but the person who set up the account couldn't have been - they would have set it up with a password as they can't access my email account. Of note here, I never verified the account when the user first signed up, so DoorDash has always just been going on the first guy's word that they are who they say they are.

deleted 7y ago
[deleted]
gtCameron 7y ago
If you control the email address on the account you could get in by resetting the password, so I'm not sure what the difference is there
- deleted 7y ago
  [deleted]
- SketchySeaBeast 7y ago
  To me the difference is the intent - I didn't intend on entering someone else's account. If I'd tried to log in with a password/email, it would have told me the account already exists, or prompted me to reset the password, and then I'd need to request that and knowingly invade the account. This way I just walked right in without even knowing what I was doing - I didn't realize there was even a problem until I went "hey, that's not my phone number!".
enjo 7y ago
I don’t see the issue? DoorDash authenticated that you own the email account via a trusted third party. Once authenticated they authorized you to use the account associated with that email address. It’d be like someone else booking a hotel room as you. When you show up at the front desk they verify it’s you and then let you into that room because it is after all... yours.
- SketchySeaBeast 7y ago
  I suppose so. I guess we assume that email ownership is digital ownership - even though they never verified that the user in fact owned the email? I wonder how that legally works - was I in the wrong for unwittingly accessing someone else's information?
- l8again 7y ago
  Actually, it's more like someone else booked a hotel room as OP. Since they were there in person, the hotel gave them the room key, and they are in that room taking a shower (updated the phone number in this case). The OP goes in and asks for a room, presents his/her email, and since it matched receives the key to the _same room_. OP then walks into the other guy's room while they are in it. At least that's my understanding of it. edit: grammar
  - dylan604 7y ago
    maybe if you said you lost your key, but if you come in and ask to check-in, the clerk isn't just going to hand you a new key. they're going to say, but mr. soandso, you're already checked-in.
paxys 7y ago
Lots of services out there let you log in using both password or an external provider (Google, Facebook etc.)
- SketchySeaBeast 7y ago
  I guess I've never experienced a service where it lets you log in with either option on the same account. At least it should have you verify the email account before assuming that the information is valid.
ahmedalsudani 7y ago
Yeah this is why you do email verification. But you gotta move fast and break things ¯\_(ツ)_/¯ Or whatever the hip phrase is now that FB is radioactive.