3 ms·
The additional confirmation is not from the user being removed, it's from the user doing the removal. In this example the API/oauth was enough to do this. There
by bkor 6y ago
The additional confirmation is not from the user being removed, it's from the user doing the removal. In this example the API/oauth was enough to do this. There really should be an additional confirmation certain times. Like how Google sometimes requires you to put in your password/2fa again, despite previously authenticating or saying something like "don't ask me again".
- marcinzm 6y agoI presume the scammer added a new account, made it an admin and then used that to take over. So it's not the removal that's the issue but adding a new admin on the account. Of course if you allow this type of activity through oauth I don't think there's a good way to re-authenticate.
- jackson1442 6y agoIn that case, adding a new admin should require re-authentication.