3 ms·
But the security hole is not that you can access someone else’s email messages.. it’s that you can do ‘I forgot my password’ flow for accounts associated with a
by aserafini 7y ago
But the security hole is not that you can access someone else’s email messages.. it’s that you can do ‘I forgot my password’ flow for accounts associated with an email address that was previously owned by someone else!
- ta999999171 7y agoThat's a major hole in web authentication...not Yahoo!'s mail service.
- throwaway373438 7y agoIt's both. Yahoo! used to maintain a policy against address reuse for exactly this reason.