moderated Re: Changing email address security issue #misc


Andy Wedge
 

On Wed, Feb 3, 2021 at 04:55 PM, Mark Fletcher wrote:

I have changed the feature so that you cannot change the email address of a member who is a moderator or owner of a group.

Is that an owner or mod of a main group only or does it include mods of subgroups which may be just members in a main group?

Should I make other changes? Should the change only affect that one subscription? That is, if someone is subscribed to 2 groups, and the moderator of one of those groups changes that person's email address, should I then create a new Groups.io account, splitting off that one subscription?

Along with the power to change someone's email address come the responsibility to use it wisely. I always get confirmation from the member in question that they understand that a change to their account address impacts all groups they are subscribed to.  Unless I get that confirmation, I don't make the change.  It can be lot less time and effort being able to make the change on behalf of someone than it is to recover the situation after their failed attempts.  It accounts are split based upon subscription I think that will generate confusion for some older members who will login with the wrong account for the group they want to interact with and wonder why they cannot access it.  Those are frequent questions on GMF.

Regards
Andy

Join main@beta.groups.io to automatically receive all group messages.