I'm making a web application where users can log in with Open ID and create their own profile on the website, so I was trying some things on stackoverflow. Now I wonder if the following is a bug or a 'feature'.
- My SO account was created using my gmail account, so it appears in my profile (optional email) and in "my logins".
- I changed my profile's optional email address to be my yahoo address.
- Opened a new incognito window, clicked Log in and identified with my yahoo email address (which is NOT in my SO account's "my logins")
- "This log in is new to stackoverflow, confirm create account ..." I clicked ok, and now I was signed in with my SO profile that is only associated with my gmail account in "my logins"
So either it's "smart" because if I changed my profile's optional email that proves that I own this email account and therefore I can link my SO account with it, even though I didn't explicitly added it to "my logins". Or it's just dangerous.
I was actually wondering what to do in this case. It seems this could be exploited further. But at the same time you don't want to mix things up and have a new SO user who has an open id login/email that is actually the same as the optional email address (profile) of another SO user. Because then what do you do when he wants to reset his password or do whatever that will send him an email notification?
Hopefully this question can help confirm that all this is secure and well thought and in any case give me advice for my personal project.