4 ms·
Correction: it's actually only possible to use an unverified email to reset the password if you don't have any verified emails on the account. Not as bad as I
by socillion 13y ago
Correction: it's actually only possible to use an unverified email to reset the password if you don't have any verified emails on the account.
Not as bad as I thought, but it still seems a bit questionable.
- benatkin 13y agoAh...makes sense. I think it's alright, and I think the problem could be largely solved by only allowing people to reset their passwords with their primary email addresses.