5 ms·

Major security threat: LinkedIn, Facebook, GitHub and secondary email addresses

• NeutronBoy 11y ago
  The security vulnerability isn't with the websites (LinkedIn, Facebook, etc) - it's with you (not keeping your email addresses up to date) and the organisation that is repurposing your email address. Having multiple email addresses associated with your account wouldn't significantly increase the attack surface (apart from increasing attack surface for phishing and the like).
  • jessaustin 11y ago
    I can't recall GitHub doing this, but LinkedIn definitely encourages one to enter lots of addresses without thinking about the security implications of losing control of one of them. They do that for cynical reasons: the more addresses they have, the more cross-referencing they can do.
    • andreineculau 11y ago
      Indeed! I haven't seen a warning on Github, but there you yourself have more incentive to link your commits to your account imho
  • andreineculau 11y ago
    But like I wrote: I cannot know when an email address gets out of my control. When I quit a job sure! But not when someone gains access, not when that mail gets recycled (or mistakenly taken as an alias - re:my dilemma in the post) Even if I kept two email addresses, resetting a password should have more steps than just "click this link once" in any of those inboxes.
• vmarsy 11y ago
  > Chances of getting your account hacked increases not n-fold, but logarithmic with each secondary email that you add due to poor security To the OP: You probably mean exponentially here? O(log n) would be much better than O(n)
  • andreineculau 11y ago
    Thank you for spotting the typo. Fixed now
• sk5t 11y ago
  An impassioned article, but the ultimate takeaway is that websites that accept ownership of an email address as some sort of identity proof do not operate optimally when you lose control of any associated email addresses. So, stick to one or two email addresses not generally subject to organizational appropriation, and accept that we don't have the tools for stronger authentication for this class of website at similar cost.
  • andreineculau 11y ago
    Too impassioned for my own taste but that's how it was in the spur of the moment. I still cannot understand what through their mind making it so easy I have never reset a password, only changed it on one of these services where I have 2FA enabled and I expected them to make use of 2FA! Like it is today, it is harder for me to change my own password (enter email and password, enter 2FA code, go to settings, enter password --- again only password ---, change password) than to reset it (enter email, click link in my inbox, change password)
• ossreality 11y ago
  Um, no. Don't reuse email addresses... and fucking enable two factor auth and none of this would have happened.