Ask HN: Is it okay that email change doesn't require my password?
On HN, changing my password requires me to type in my existing password. This makes sense: it prevents someone with my session from stealing my account.
However, there doesn't seem to be anything preventing someone from changing my email and submitting a password change request. It seems like a lot of websites allow this.
1 comment
[ 3.8 ms ] story [ 11.4 ms ] threadYou'd be suprised how adhoc site security can be, even for popular websites. Since changing the email effectively does allow you to change the password, it is not a bad observation.