Account Security

[kalobkalob]

A feedback request is a security flaw for a person's account. It provides access to a resume's setting page to anyone who's been sent a feedback request email.

The simplest thing at this point to correct this would be to remove extra buttons.

[tylerbenson]

Those settings buttons should be for your account even if on a different resume.

[kalobkalob]

It gave me access to the other account. I was testing this between two accounts. bsbenson@gmail.com and kalobkalob@yahoo.com. With bsbenson the name saved is Ben Benson, with kalobkalob the name listed is Bob Knob. When I changed the Ben Benson's email to kalobkalob@yahoo.com it showed the Bob Knob's setting page.

[UnspeakableHorror]

I found out what's happening, using the link does not terminate any existing session which allows you to try and change the email address, this fails because the username already exists BUT somehow ends up login you in with the other user's account.

On the other hand the only way to actually execute this attack is:

• Have access to the other user email account to get the link.
• Have the other user login on the same browser. Doesn't work otherwise.
• Be logged in with your account on Vyllage and use the previously obtained link to access the other user's Vyllage account.

If you already have access to the other user's email account there's not much that we can do on that.

I'll fix the "being able to change your email to an existing email" though, that should not be possible.

[tylerbenson]

Perhaps in the future we should offer to combine/merge the accounts rather than completely blocking it. That ability doesn't currently exist, right?

[UnspeakableHorror]

You mean merging accounts when, for example, a user registers with LTI and then registers another account with /register? No, that's not possible right now.