3 ms·

Also your git commit email needs to be added to your GitHub account for it to link to your GitHub account. And then it can be used to reset your passwords. So y

Also your git commit email needs to be added to your GitHub account for it to link to your GitHub account. And then it can be used to reset your passwords. So you'd better make sure you pick one that you're in control of. Unless you ignore the confirmation email that gets sent to you. If you already have an email address in your GitHub account that you want to use for the purpose of linking commits but don't want to be usable for resetting passwords, and you've already verified it, you can delete the email address and then just add it back, and then delete the verification email that gets sent. I've written to GitHub twice, once to their support address and once to their security address about it and they were pretty middle-of-the-road about it. But twitter has a big issue with fraudulent password resets so I wish they'd make it so only the primary email can be used for password resets, or provide a way to say which email addresses can be used for password resets.

socillion 13y ago
> Also your git commit email needs to be added to your GitHub account for it to link to your GitHub account. And then it can be used to reset your passwords. So you'd better make sure you pick one that you're in control of. I just tested it and successfully reset my password without ever verifying the new email address - so it's an open invitation for someone to hijack your account if you don't control the fake one. Beats me what the purpose of the verification is.
- benatkin 13y ago
  Also at least one of GitHub's employees has an email address from a company that he used to work for. This just shows that not everyone who signs up for GitHub uses an email address that's under their control. https://github.com/github/linguist/commit/99c296264ab320d41c6737b679cb57e005ed2ffa.patch https://github.com/github/linguist/commit/99c296264ab320d41c...
  - socillion 13y ago
    Correction: it's actually only possible to use an unverified email to reset the password if you don't have any verified emails on the account. Not as bad as I thought, but it still seems a bit questionable.
    - benatkin 13y ago
      Ah...makes sense. I think it's alright, and I think the problem could be largely solved by only allowing people to reset their passwords with their primary email addresses.

socillion 13y ago

> Also your git commit email needs to be added to your GitHub account for it to link to your GitHub account. And then it can be used to reset your passwords. So you'd better make sure you pick one that you're in control of. I just tested it and successfully reset my password without ever verifying the new email address - so it's an open invitation for someone to hijack your account if you don't control the fake one. Beats me what the purpose of the verification is.

benatkin 13y ago
Also at least one of GitHub's employees has an email address from a company that he used to work for. This just shows that not everyone who signs up for GitHub uses an email address that's under their control. https://github.com/github/linguist/commit/99c296264ab320d41c6737b679cb57e005ed2ffa.patch https://github.com/github/linguist/commit/99c296264ab320d41c...
- socillion 13y ago
  Correction: it's actually only possible to use an unverified email to reset the password if you don't have any verified emails on the account. Not as bad as I thought, but it still seems a bit questionable.
  - benatkin 13y ago
    Ah...makes sense. I think it's alright, and I think the problem could be largely solved by only allowing people to reset their passwords with their primary email addresses.