Changing email address !
 

Hello,

I just logged in to try VB4 (as I haven't been around for many years), the first thing I tried to do was changing my email address in my profile page.

I'm so over-impressed with how easy it was to change the email.

Simply: Go to Settings->Edit Email & Password -> Enter your NEW email twice -> click on the activation link in your NEW email-> DONE!

The problem with this setting is that many of forums users are not conscious enough about security, so they are likely to to forget to log-off from the forum. Therefore, someone would simply get FULL control of their profile by simply changing the email address.

Solution: before sending the email to the NEW address, why not send it to the OLD one first to verify the request ? This is a double authentication approach.

If someone no longer has access to their old email, then some other less risky solution should be looked for.

Thanks