Oops... Did I just give away my nation?

[Topid]

It's a puppet, so I won't be totally heart-broken... But I applied to the WA with a puppet so that I could switch WA nations, and I entered the wrong email. The email went to an address similar to mine, but not mine...

So, if someone clicks the link on that email they can log in as me and do.... Whatever they want?

[And I know the odds of whoever owns that email actually having heard of NS is small, so the email will probably be ignored.]

[Khornate Worshippers]

You can change your e-mail and your password.

[Topid]

You can change your e-mail and your password.

Yes I can. But when you join the WA it just sends you a link and once the link is clicked it logs you in.

They don't need my password to log in, and changing my email address won't unsend the email. The stranger would still have it.

[Weylara]

Send an email to the person explaining your mistake?

[The Archiepelago]

That sucks. I feel bad for you. did you try contacting support or someone? (Why does it say i posted it at 10:26pm? It's 1:27am here)

[Khornate Worshippers]

Has the WA accepted them yet? If they haven't, unapply.

[Topid]

I don't really care about the nation, I just needed another defender puppet in case I need to go on a defender mission... The issue I have is that someone could do this to their main nation. And that would suck. You should probably have to enter a password or something...

Has the WA accepted them yet? If they haven't, unapply.

Yeah they accepted me.

[Arumdaum]

Send an email to the person explaining your mistake?

Nobody would do that, unfortunately.

[Klaus Devestatorie]

Try to determine if the mistake email address even exists first- http://centralops.net/co/

[Topid]

It does exist. That was the first thing I tried.

I didn't make this thread to see if I could save my puppet. I don't really care about it at all. But I do want to point out to the admin that this looks like a significant security risk. I switch emails and WAness all the time. If I did this to my main I'd be freaking out! I think we should have to enter our password on the WA application page before the link will work.

[The Emmerian Unions]

[Not a tech person] I believe that:

No, you did not give away your nation. As long as they don't have your nation's password, the nation is safe. You don't need to confirm your nations password to be accepted to the WA.

[Bears Armed]

I don't really care about the nation, I just needed another defender puppet in case I need to go on a defender mission... The issue I have is that someone could do this to their main nation. And that would suck. You should probably have to enter a password or something...

Has the WA accepted them yet? If they haven't, unapply.

Yeah they accepted me.

So if you resign that nation from the WA, wouldn't that automatically invalidate the message that's been sent to the other email?

(CAUTION: writer is not a programmer...)

[Gangal]

Does the WA link auto-login using the nations password behind the scenes, or does it bypass the password completely? If the former, I would think changing the pw would prevent the login. If the later, that is a VERY serious security matter.

[Khornate Worshippers]

Have a program auto-refresh a NS page while you're logged into your account. When/if they change your password, change it straight back.

[Topid]

[Not a tech person] I believe that:

No, you did not give away your nation. As long as they don't have your nation's password, the nation is safe. You don't need to confirm your nations password to be accepted to the WA.

Right. So if someone gets a wrongly addressed application to the WA, they can click the link and log in one time without a password (and changing the password).

I don't really care about the nation, I just needed another defender puppet in case I need to go on a defender mission... The issue I have is that someone could do this to their main nation. And that would suck. You should probably have to enter a password or something...

Has the WA accepted them yet? If they haven't, unapply.

Yeah they accepted me.

So if you resign that nation from the WA, wouldn't that automatically invalidate the message that's been sent to the other email?

(CAUTION: writer is not a programmer...)

I mean they accepted my application, not admitted me. I can't resign because I never got in because the email went to the wrong place.

I guess if this happened to someone else they could re-apply and join, which would invalidate the old email. But that would still leave a nation at risk for 12 hours.

Have a program auto-refresh a NS page while you're logged into your account. When/if they change your password, change it straight back.

I guess someone could do this. Bit extreme though.

[Pythagosaurus]

If they control the e-mail address listed on your nation, they can get in anyway. And the e-mail address that's used is the one on your nation when the daily update checks WA eligibility, so you must have left it that way for a while. I can make it so you still have to have the same e-mail address when you accept (and/or the password hash check). Other than that, there's nothing we can do to really mitigate the risk. As usual, the best course of action is not to put somebody else's e-mail address in the field.