It is possible to log in with my Yahoo OpenID (which is tied to my Yahoo e-mail account), and then create a new unregistered user with the same e-mail address, so that both accounts are connected to the same e-mail. Why is that allowed? Shouldn't Stack Overflow have some sort of e-mail confirmation?

  • 3
    This is not something that SO can influence in any way, is it? It's simply that the two OpenID providers don't check for cross-duplicates. Nor should they, really. – Pekka supports GoFundMonica Sep 8 '11 at 13:47
  • @Pekka I don't use the yahoo email for the myopenid, so even if the openid providers would do this, it wouldn't matter, I've entered the yahoo email on the user edit page of SO – Omu Sep 8 '11 at 13:50
  • Ah, so you have two accounts with the same E-Mail address? – Pekka supports GoFundMonica Sep 8 '11 at 13:50
  • @Pekka yes, one e-mail yahoo used as OpenID, and another one that I entered on the user edit page for the second account (logged in with myopenid) – Omu Sep 8 '11 at 13:52
  • @Omu do you have the "E-Mail" field filled twice with the same address? – Pekka supports GoFundMonica Sep 8 '11 at 13:56
  • @Straitjacket not really, that question is about having many accounts, this is about having many with same e-mail, notice the difference – Omu Sep 8 '11 at 13:56
  • 1
    @Pekka no, I login with yahoo but I can also login with gmail, and it's the same account, for these 2, my yahoo and gmail are merged into one, so when I login with yahoo I have the gmail email in use, I kinda get it now – Omu Sep 8 '11 at 13:58

Your e-mail isn't the key to your account. Your OpenID endpoint name is the key, and those are unique for your accounts. The e-mail address is irrelevant, and does not need to be confirmed, because it was confirmed separately by your openID provider.

  • the thing is that you can use another email which wasn't confirmed by the openid provider, I do understand now that in the case when the users is not using openid but registers he is confirming his email and gets an unique SE openid anyway – Omu Sep 8 '11 at 14:02
  • Hasn't the recent change to the login system made email more important? As I understand it, if you have any email address associated with your account, you can login using any trusted OpenID that is associated with that email (facebook, gmail, stack exchange) even if you haven't previously associated it with your account. – Jeremy Banks Sep 8 '11 at 14:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .