about the security of the account mail

meihuak

now if you know the password of the account, you can change a new email.
there is one account was stolen in my Flarum and the email was changed.
so I think if you want to change email you should send mail to the previous email to confirm first

luceos

Other platforms usually inform the old email address about the change and offer a way to contact support. Blindly demanding confirmation from the old email address might be problematic when the person behind the account no longer has access to that email address (company email, deleted address, forgotten credentials, full inbox etc..).

In addition, your password should be private, sharing it is the root of evil, the cause of doom in this scenario.

tankerkiller125

luceos In addition, your password should be private, sharing it is the root of evil, the cause of doom in this scenario.

As a further note on this, you should have a unique random password for every site and service you visit, and store it in something like 1Pass, Bitwarden, etc. some are free to start using, and are well worth the effort.

I'll admit that despite being an IT guy I haven't always been good about this kind of thing, but I've done way better over the last year or two and it's paid off.