4 ms·

As the article mentioned, adding 2FA is solving the issue.

• julianlam 4y ago
  Not really, solving the issue via added complexity is not the ideal solution. ... and I say this as a vigorous proponent of second factor authentication. The real fix here is to completely change how the service handles email addresses. You can continue to request it, but it cannot be used as an identifier until it is confirmed.
  • tgv 4y ago
    Indeed. But allowing to set passwords only from the email link should be a simple change.
    • wang_li 4y ago
      That and requiring email verification before you even ask their name or any other signup information.