# Issue: user changed google account and can't connect thru his profile **URL:** https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028 **Category:** Support **Created:** [2015 年 10 月 28 日午後 5:36 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028 "2015-10-28T17:36:34Z") **Posts on this page:** 1 **Showing post:** 22
### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david) #### Post date: [2019 年 3 月 1 日午後 5:29 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028/22 "2019-03-01T17:29:28Z")
@supermathie now that we’re [migrating all the auth providers to use the same logic](https://meta.discourse.org/t/future-social-authentication-improvements/94691), this logic will need to be refactored / removed. A lot has changed in the authentication system since 2017. The main thing is that users can connect/disconnect accounts whenever they want. As I understand it, this change was added to protect against: - User connects google account 00001, with email [user@example.com](mailto:user@example.com), to their discourse account - User tries to log into discourse using google account 00002, with email [user@example.com](mailto:user@example.com) - Error is shown, must be resolved on the console Under the new “ManagedAuthenticator”, this would happen: - User connects google account 00001, with email [user@example.com](mailto:user@example.com), to their discourse account - User tries to log into discourse using google account 00002, with email [user@example.com](mailto:user@example.com) - User logged in, reference to 00001 is scrubbed and replaced with 00002 I believe this is also the same method we follow with core [Discourse SSO](https://meta.discourse.org/t/13045?silent=true). This seems fine to me. If a user is in control of a google account with a matching email address, then we should trust them. Was there a specific attack vector you were trying to protect against with this error message, or can we go ahead and make it match the other authenticators? --- _[View the full topic](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028)._