Hacker News Reader

Comment by SketchySeaBeast | Hacker News Reader

Nope. I was using the built in Android Account linking (like if you link up your Facebook account to an application OAuth style), but the person who set up the account couldn't have been - they would have set it up with a password as they can't access my email account.

Of note here, I never verified the account when the user first signed up, so DoorDash has always just been going on the first guy's word that they are who they say they are.

View on HN

If you control the email address on the account you could get in by resetting the password, so I'm not sure what the difference is there

To me the difference is the intent - I didn't intend on entering someone else's account. If I'd tried to log in with a password/email, it would have told me the account already exists, or prompted me to reset the password, and then I'd need to request that and knowingly invade the account. This way I just walked right in without even knowing what I was doing - I didn't realize there was even a problem until I went "hey, that's not my phone number!".

I don’t see the issue? DoorDash authenticated that you own the email account via a trusted third party. Once authenticated they authorized you to use the account associated with that email address.

It’d be like someone else booking a hotel room as you. When you show up at the front desk they verify it’s you and then let you into that room because it is after all... yours.

I suppose so. I guess we assume that email ownership is digital ownership - even though they never verified that the user in fact owned the email? I wonder how that legally works - was I in the wrong for unwittingly accessing someone else's information?

Actually, it's more like someone else booked a hotel room as OP. Since they were there in person, the hotel gave them the room key, and they are in that room taking a shower (updated the phone number in this case). The OP goes in and asks for a room, presents his/her email, and since it matched receives the key to the _same room_. OP then walks into the other guy's room while they are in it. At least that's my understanding of it.

edit: grammar

maybe if you said you lost your key, but if you come in and ask to check-in, the clerk isn't just going to hand you a new key. they're going to say, but mr. soandso, you're already checked-in.

Yeah this is why you do email verification. But you gotta move fast and break things ¯\_(ツ)_/¯

Or whatever the hip phrase is now that FB is radioactive.

Lots of services out there let you log in using both password or an external provider (Google, Facebook etc.)

I guess I've never experienced a service where it lets you log in with either option on the same account. At least it should have you verify the email account before assuming that the information is valid.

Reply on news.ycombinator.com