4 ms·
One small problem is that github uses email addresses both for associating commits and for password resets. This means that if someone used their company email
by benatkin 12y ago
One small problem is that github uses email addresses both for associating commits and for password resets. This means that if someone used their company email account for commits to an open source project, and left the company, once they removed the email address from their account, their commits would no longer be associated. Or, they could leave their email address in their account, but if someone hacked it they could use it to initiate a password reset.
It would be nice if in the list of email addresses there was something showing whether it can be used to recover their account, and the ability to change it (requiring them to have at least one email address that can be used with account recovery).
Two factor auth helps with this, I think.
- akerl_ 12y agoEDIT: After testing, my statement below is wrong. I've hit up GitHub to see if they'll fix either the wording or behavior. I haven't tested it, but based on the description, it seems that only the "Primary GitHub Email" would be used for password resets: https://github.com/settings/emails https://github.com/settings/emails Other added emails would thus be used for associating commits but not for regaining account access.
- benatkin 12y agoThe reason it seems that way to you is because you haven't tested it. The email address has to be verified, but any of the verified email addresses can be used to reset passwords. There is no way to un-verify an email address besides deleting it and re-adding it.
- akerl_ 12y agoIf that's the case, I'll be reaching out to GitHub to clarify the wording once my test shows otherwise. I specifically pointed out that I was basing my understanding on the message they provide. EDIT: I've confirmed the wording doesn't match the execution, and I've send a message to GitHub
- benatkin 12y agoThanks! I sent them an email a year or two ago and they haven't addressed it. It is a bit of an edge case, and there's a workaround. So I'm not annoyed that they haven't fixed it, but I will be glad when they do.