hasgeek/lastuser

Email domain discovery weakness

jace opened this issue · 2 comments

jace commented

A user who has an email address at a particular domain (non-webmail only) can discover all other users with email addresses at that domain by creating an organization associated with that domain. This will add all those users as members.

This is currently not high impact (mostly gmail users), but could potentially be.

jace commented

The only obvious resolution to this issue is by reversing #108 and removing automatic team membership by domain. We may revisit this with a better solution in #185 with periodic verification.

jace commented

Fixed in 44d995e