If a user has located their account (so they know its username and id), but does not know their password (nor have a 1FA authentication method added, like CTAP2), they are unable to acquire the e-mail address of the account by merely appending .json to the relevant profile URI. Consequently, how ar…

[صورة] roke_julian_lockhart: Consequently, how are they to request a password reset, considering that the password reset form requires an e-mail address they can search their various email accounts for the forum domain? how many email addresses do they have? :laughing: If all else fails… s…

Staff users can see a user’s email address that they registered with. The staff can tell the user what their email is, so that the user can log in. Email cannot be viewed in the JSON. In fact, it’s quite hidden, even for staff (i.e. behind the ‘Show’ button), and is logged IIRC into staff logs. Is…

@awesomerobot and @NateDhaliwal , the problem with these approaches is that I recently experienced this at community.openAI.com, because I utilise an e-mail alias service, as many nowadays do. Though, it would be worse if one had merely sub-addressed their e-mail address, which is common practice, as…

Hi @roke_julian_lockhart , [صورة] roke_julian_lockhart: Consequently, how are they to request a password reset, considering that the password reset form requires an e-mail address; it does not accept a username? It does accept a username, though. [صورة] roke_julian_lockhart: I recently e…

@southpaw , so the ability to accept a username during password resets is a preference, which they have disabled? I ask because what I observe there is: [image] If so, perhaps that should be made more clear, with something like: This Discourse instance has disabled username-based password reset. …

[صورة] roke_julian_lockhart: I do not understand why the form, that you have submitted a screenshot of, appears to differ from what I observe even here. I’m certain you would agree that preventing others from finding out your email address must be a top priority of the site. To that end, ther…

[صورة] southpaw: I’m certain you would agree that preventing others from finding out your email address must be a top priority of the site. To that end, there is a site setting admins can choose to enable that provides an extra layer of protection by refusing to give people hints if they try to …

[صورة] roke_julian_lockhart: because I utilise an e-mail alias service ah yeah that’s a reasonable case… though I’d imagine an email alias service should keep some record of which aliases have been used where? Apple’s does but I don’t have experience with others to know for sure. Maybe worth…

[صورة] roke_julian_lockhart: Had I not been able to discover my e-mail address, I would have been out of luck. That’s right. If you want to use a service and continue to use the service, it’s your responsibility to know what email address you used. If you forget, then you have to create a new…

[صورة] pfaffman: If you want to use a service and continue to use the service, it’s your responsibility to know what email address you used. @pfaffman , I didn’t forget. Rather, OpenAI haphazardly disconnected their SSO integration, silently replacing it with an e-mail address inherited from t…

كيف يجب أن يطلب المستخدم إعادة تعيين كلمة المرور عندما لا يتذكر عنوان البريد الإلكتروني الذي تستخدمه إحدى حسابه؟

الدعم

roke_julian_lockhart (Mr Beedell, Roke Julian Lockhart) 5 أغسطس 2026، 1:53ص 12

@awesomerobot، شكرًا. لقد قمت بتقديم طلب:

الموضوع		الردود	مرات العرض
Always allow username-based password reset Feature login	4	205	6 أغسطس 2026
Different password reset for wrong username/email Feature	64	28443	4 أكتوبر 2017
Password reset email should send IP info Feature	45	3364	27 فبراير 2018
Email enumeration vulnerability on "Password Reset" dialogue UX	19	4514	19 ديسمبر 2024
Forgot_password abuse Feature	23	2646	26 أبريل 2022

كيف يجب أن يطلب المستخدم إعادة تعيين كلمة المرور عندما لا يتذكر عنوان البريد الإلكتروني الذي تستخدمه إحدى حسابه؟

الموضوعات ذات الصلة