Handling old accounts that have changed emails?

If you visited a Discourse a long time ago, and no longer control the email address your account was originally created under – how can we get that user back into their account?

I guess there are two options here:

  1. You don’t remember which email it was, and you don’t control that email address any more

  2. You do remember which email it was, and you don’t control that email address any more

So you’d issue a standard forgot password request …

I guess the only option here is to contact staff out-of-band via the /about page email address and ask them to change the email on the account? This is extra tricky if you don’t remember the email address you signed up with – how does this other user prove that they are, in fact, the person who originally controlled the old email account?

I wonder how we can provide information / assistance to the user on these two dialogs to handle this rare, but highly unfortunate, scenario without it being TL;DR for everyone else.

Maybe a small link to the staff page on this dialog makes sense to handle that and other unusual login scenarios where staff intervention is inevitable and required. Or perhaps a “help” button on this dialog, so that way we’re not smacking every workaday “forgot my password again” user with a bunch of extraneous information that is only useful in these rare cases?

5 个赞

Maybe it would be helpful to reveal some characters of the email. perhaps 3 characters? I see many big businesses do it.

we found username example and sent an email to nam*@example.com** , …

6 个赞

OK! @techapj added this help feature and I will use this copy for it:

Email not arriving? Be sure to check your spam folder first.

Not sure which email address you used? Enter an email address and we’ll let you know if it exists here.

If you no longer have access to the email address on your account, please contact our helpful staff.

4 个赞

我理解得对吗?如果管理员更改了用户的邮箱地址,用户必须通过新邮箱地址进行确认,但旧邮箱地址不会收到关于此更改的通知?

至少减轻恶意接管他人账户影响的一种方法是:每当由工作人员触发邮箱更改时,向旧邮箱地址发送通知,告知其新的邮箱地址。

最后,有一个小问题:在这种情况下,新邮箱地址何时正式生效?是立即生效,还是在新邮箱确认之后?我假设是后者,但想确认一下。

1 个赞

我现在注意到,在两次地址变更中,确实发送了一封 notify_old_email 通知。我没能找到对应的邮件模板,但我怀疑这封邮件是在新邮箱确认之后才发出的。是这样吗?

这仅适用于工作人员账户。出于加强安全性的考虑,工作人员用户必须同时确认旧邮箱和新邮箱。

(如果他们在某种情况下失去了对旧邮箱的控制权,这将变得不可能。但由于此规则仅适用于工作人员,您 hopefully 只需极少情况需要处理此类问题。)