3 ms·
This is a massive security flaw if true.
by jpxw 7y ago
This is a massive security flaw if true.
- londons_explore 7y agoAll webmail providers used to delete old accounts and then allow re-registering them. On-the-ball webmail providers don't allow this anymore, but some never changed their ways...
- Spivak 7y agoNot for the email provider. If the only authoritative identity for an account is “can receive an email at a given address” you’re just admitting that you’re outsourcing your security to an implementation detail of a few large email providers that you have no control over and a bunch of small email providers that you have no guarantee behave the same way. A trivial example is Mailinator.