Naive answer: You already do. You can't get to the change option if you're not logged in.
i know that. what i was talking about was CSRF.
Cynical Answer: If someone else can get the ability to change your email, it's already compromised.
Do you know what CSRF is? I can setup a html form on a different website that has a masked button or even a javascript-submit. it will change your email address if you visit this page (and click the harmless looking button if you don't have javascript enabled).
My opinion: More trouble than it's worth in terms of real security enhancement.
well, if you knew CSRF you wouldn't say that.

with CSRF i have been able to automatically send myself a message everytime a monk visited my homenode (i tested this just to see if it worked). so if you visited my homenode i would have gotten e message by you. i could have also send out faked message to others. this is the same technique. and changing email and password is the most vulnerable kind of security hole. if you can do that you immediately can take over an account.

update: i tested it. everybody who wants to test it send me a message. be sure to open and save a form to change your user data before. otherwise your old user information will be all gone.

In reply to Re^2: Password required for email change by tinita
in thread Password required for email change by tinita

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.