Hacker News Reader

The security vulnerability isn't with the websites (LinkedIn, Facebook, etc) - it's with you (not keeping your email addresses up to date) and the organisation that is repurposing your email address.

Having multiple email addresses associated with your account wouldn't significantly increase the attack surface (apart from increasing attack surface for phishing and the like).

View on HN

I can't recall GitHub doing this, but LinkedIn definitely encourages one to enter lots of addresses without thinking about the security implications of losing control of one of them. They do that for cynical reasons: the more addresses they have, the more cross-referencing they can do.

Indeed! I haven't seen a warning on Github, but there you yourself have more incentive to link your commits to your account imho

But like I wrote: I cannot know when an email address gets out of my control. When I quit a job sure! But not when someone gains access, not when that mail gets recycled (or mistakenly taken as an alias - re:my dilemma in the post)

Even if I kept two email addresses, resetting a password should have more steps than just "click this link once" in any of those inboxes.

Reply on news.ycombinator.com