Boards›[ARCHIVED] Miscellaneous

[FEEDBACK] E-mail Security - Sharing An Idea

Larti·1/9/2014, 6:27:01 PM·1 votes·710 views

So I just noticed that to change the e-mail of my account, is pretty simple. But I don't think that's even a bit safe. It seems that stealing someone's password is easy and just with that, just with the password, you can change the course of the account by simply entering on the website, changing the password and then changing the e-mail (there is not even one e-mail sent to the original e-mail to confirm these changes!!!) If this is about convenience, forget about it! Such big company cannot afford this sort of stuffs! Security is a need!

I believe that it would be wiser, if not, safer to change this. Please hear me out RIOT.

So I thought of this:

. Instead of simply being the otpion "New E-mail Adress" (the other options are irelevant) and simply going to that E-Mail and confirm the change, why not placing an option before that one "Original E-Mail Adress" and then yes "New E-Mail Adress".

What I seek with this is quite simple. By doing this, whoever has the password, no matter what happens, he won't change the password, he won't change the e-mail IF there is a mail sent to the ORIGINAL mail FIRST, CONFIRMING the PASSWORD and/or E-MAIL change.

(NOTE: There is no specific place to put feedback like this anywhere!!! (help me if there is) Maybe it would be a good idea to add one?)

Much thanks for reading.

3 Comments

CaptainCuul1/9/2014, 8:20:57 PM2 votes

Or they could request that you first give a reason why, and then have it confirmed in the original e-mail address. In this case, the owner of the account would get an immediate red flag, and could contact riot for an account leak.

Drunk Old Man1/10/2014, 2:23:14 AM1 votes

Having created many websites myself, I can agree with this. There's no formal security system in place for things like forgetting a password or email, instead we can just log in and change our email and password. And the "measures" that are in place are vastly insecure.

For the email thing, yes, there should be a verification email sent to the old email and/or have a security questions thing in place. Another alternative is to have SMS/Phone used for verification (which is supposedly in the works.)

For passwords, as above, we need security questions and/or SMS/Phone, as well as an email verification link.

Anything else? Combination of the above. It's pretty simple, and every other big site/game does it. Riot isn't that old, so I can forgive the small mistakes. But here's to hoping that they sort it out in the near future. Things like this aren't really hard at all.

Larti1/10/2014, 8:34:16 PM1 votes

It's live guys! It exists and e-mail confirmation now! http://euw.leagueoflegends.com/node/10286