mozilla/browserid — Issue #814: It is possible to "combine" accounts through myfavoriteshow.org
Author: jbonacci
Created: 2011-12-28 21:54:30+00:00
State: open

Found this by accident but found it gave a unexpected result which should either be fixed or documented.

Log into browserid.org with a known account.
Verify the account and associated emails.
Open myfavoriteshow.org
Use a known email not part of the current account.
In the UI, you will be asked to verify the email.
Verify the email by clicking on the link.
Note that you are now signed into myfavoriteshow.org with that email.
Now, go back to browerid.org and click on the BrowserID link (or just refresh).
Note that the email from myfavoriteshow.org is now part of this known account.

Repeat the above steps while not logged into browserid.org
You will get the expected result of being able to immediately sign-in to myfavoriteshow.org with the known email.
(no email verification is needed)
And, no side-effect of "consolidation" of emails.