Please consider validating the email when it is change in the user account. Similar to the "Registration Account Email Validation". I believe that if someone hacks your account and try to change the email, you get a validation and confirmation link by email to confirm this change.

For security reasons I think this is the correct approach. Many sites like Twitter and Facebook uses this approach.

  • 3
    I assume you mean the free text email field when editing the profile? In this case, that's not the email used to log in. To log in you must use OpenID provider. – Shadow Wizard Wearing Mask V2 Dec 26 '12 at 15:06
  • Really? Didn't know. Thanks for clarifying. I got scared, because it was to easy. – Ignacio Correia Dec 26 '12 at 17:06
  • I notice that it changed my Avatar so this email is used to integrate with Gravatar. That is a nice information to add there, I didn't know this also. – Ignacio Correia Dec 26 '12 at 19:18
  • 1
    Yeah, looked for some official information about it and din't find any. This email is used for the gravatar indeed and also for email notifications as far as I know. – Shadow Wizard Wearing Mask V2 Dec 26 '12 at 19:32
  • Really for notifications? Dam! :( – Ignacio Correia Dec 26 '12 at 19:47
  • At some places you can choose different email but that's what appears as default and when you choose to subscribe to a specific tag, yep. – Shadow Wizard Wearing Mask V2 Dec 26 '12 at 19:58

You must log in to answer this question.

Browse other questions tagged .