<div dir="ltr">Hi!<div class="gmail_extra"><br><div class="gmail_quote">On Fri, Nov 27, 2015 at 11:23 AM, Vlastimil Elias <span dir="ltr"><<a href="mailto:velias@redhat.com" target="_blank">velias@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">2. remove validation of current password (remove "Password" field). Two<br>
reasons for this:<br>
- security impact of this check is small. If attacker is able to<br>
compromise Account app then he can always change email and then use<br>
"Forgot password" feature to change password<br>
- user created over Identity Provider do not know old password<br>
(because it is not set) so he is not able to set password using this screen<br>
After we implement support for reauthentication (KEYCLOAK-2076) then we<br>
should set some reasonable reauth timeout for Account app instead, this<br>
will make it more secure at all.<br></blockquote><div><br></div><div>Wouldn't it make more sense to add password validation when changing email?</div><div><br></div><div>Best regards,</div><div>Thomas</div><div></div></div>
</div></div>