sp614x / optifine

1.81k stars 416 forks source link

[Login] Ability to find lost emails. #3895

Open JackDotJS opened 4 years ago

JackDotJS commented 4 years ago

image

image

A problem we see often is that people have forgotten what email they used when donating. Instead of just trying every single email one might remember, we could have a link on the login page of optifine.net. (example above)

This page allows you to simply enter your Minecraft username. Assuming you have a cape activated, this will find the email of the donation account that owns that cape, and do one of the following:

1. Send a reminder email

This simply sends a new email to the donation email address, stating something along the lines of:

Hello, this is a reminder of your donation email. 

You're receiving this message because you or someone else is trying to recover a forgotten email. 
If you did not make such a request, you can safely ignore this message.

To prevent spam/abuse, these emails can ONLY be sent up to 2-3 times in a row. This counter is reset once the user has logged in.

2. Display the email (almost) directly

Let me first say that I would NOT recommend the following method for the sake of keeping accounts as secure as possible. This is simply an idea, albeit a potentially dangerous one.

An even more convenient option would be to display the email directly after submitting the username. Again, although much quicker and easier (maybe even more effective), this could potentially be MUCH less secure. Malicious parties could use this to find the donation email of known cape owners. To protect against this (and for the sake of having some security in this method), this email could be obscured like so:

wi********sk@gmail.com

(I'd also make the stars random lengths to further obscure the original address.)

Although it does not give you the entire email, it does at least give you a clue. For most people, this should be enough to find their lost emails.

JackDotJS commented 4 years ago

lol i assigned myself out of habit, oops