4 ms·
> Also your git commit email needs to be added to your GitHub account for it to link to your GitHub account. And then it can be used to reset your passwords. So
by socillion 13y ago
> Also your git commit email needs to be added to your GitHub account for it to link to your GitHub account. And then it can be used to reset your passwords. So you'd better make sure you pick one that you're in control of.
I just tested it and successfully reset my password without ever verifying the new email address - so it's an open invitation for someone to hijack your account if you don't control the fake one.
Beats me what the purpose of the verification is.
- benatkin 13y agoAlso at least one of GitHub's employees has an email address from a company that he used to work for. This just shows that not everyone who signs up for GitHub uses an email address that's under their control. https://github.com/github/linguist/commit/99c296264ab320d41c6737b679cb57e005ed2ffa.patch https://github.com/github/linguist/commit/99c296264ab320d41c...
- socillion 13y agoCorrection: it's actually only possible to use an unverified email to reset the password if you don't have any verified emails on the account. Not as bad as I thought, but it still seems a bit questionable.
- benatkin 13y agoAh...makes sense. I think it's alright, and I think the problem could be largely solved by only allowing people to reset their passwords with their primary email addresses.