new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authentication/email_change

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Email change process notes on alternative approaches

Google adopts a different approach with accounts secured only by password where the current email address receives a notification-only email. This method carries risks and requires user vigilance. Regular social engineering training is crucial for system administrators and help desk staff to follow the prescribed process and recognize social engineering attacks. Refer to CISA's 'Avoiding Social Engineering and Phishing Attacks' for guidance.

Email change process without MFA enabled

When a user without Multifactor Authentication enabled wants to change their registered email, follow these steps: 1) Confirm validity of user's authentication cookie/token. If not valid, display login screen. 2) Describe the email change process to the user. 3) Ask user to submit proposed new email address, ensuring it complies with system rules. 4) Request user's current password for identity verification. 5) Store proposed new email as pending change. 6) Create and store three time-limited nonces: for system administrators' notification, user confirmation, and additional step for password reliance. 7) Send two email messages: a confirmation-required email to the current address instructing user to confirm change with link for unexpected situations, and a separate confirmation-required email to the proposed new address with same instructions. 8) Handle responses from links accordingly.

Give your agent this brain