3 ms·
The security vulnerability isn't with the websites (LinkedIn, Facebook, etc) - it's with you (not keeping your email addresses up to date) and the organisation
by NeutronBoy 11y ago
The security vulnerability isn't with the websites (LinkedIn, Facebook, etc) - it's with you (not keeping your email addresses up to date) and the organisation that is repurposing your email address.
Having multiple email addresses associated with your account wouldn't significantly increase the attack surface (apart from increasing attack surface for phishing and the like).
- jessaustin 11y agoI can't recall GitHub doing this, but LinkedIn definitely encourages one to enter lots of addresses without thinking about the security implications of losing control of one of them. They do that for cynical reasons: the more addresses they have, the more cross-referencing they can do.
- andreineculau 11y agoIndeed! I haven't seen a warning on Github, but there you yourself have more incentive to link your commits to your account imho
- andreineculau 11y agoBut like I wrote: I cannot know when an email address gets out of my control. When I quit a job sure! But not when someone gains access, not when that mail gets recycled (or mistakenly taken as an alias - re:my dilemma in the post) Even if I kept two email addresses, resetting a password should have more steps than just "click this link once" in any of those inboxes.