Trustmaster |
|
---|---|
Well, my 5 cents. I sometimes encounter these problems about emails:
[list=1] Well, if you talk security, the problem is that if somebody has intercepted user's session, he can go to profile, change email and request password recovery for that email. And this way he steals the account completely. If all you want to avoid is this problem, I would advise just prompt for a password when user changes email. No complex coding, no extra database stuff. May the Source be with you!
|