How do I securely allow users to change their emails if they lose access to the original email? Do I need 2 factor?

It's a social media site coded in nodejs where I have their username, password, and email address. Users sometimes want to change their emails because they lost their password to their old email address. However I use sending confirmation emails to their email as my way of authentication for actions like changing password. What can I do or is there no way but to just allow this be an insecure action.

I'm concerned that if someone, say a girlfriend or a roommate gets access to a computer that person is on and claims a lost email they can take over the account.

  • 2FA using google authenticator might help.
    – Steve
    Sep 12, 2020 at 22:56

1 Answer 1


Yes with a way to verify the users identity that does not include accessing or sending a link to their old email. I would setup either 2FA or use the good old 3 questions, but with questions there is a chance that other people could know the answers and could reset it, 2FA using GAuth seems the way to go as the person that owns the account will/should have access to that personal device and as you know those codes expire often and cannot be guessed by a significant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.