[Mailman-Users] Wish: Change address.

[J C Lawrence]

On Wed, 07 Feb 2001 15:29:45 +0000 
Nigel Metheringham <Nigel.Metheringham at InTechnology.co.uk> wrote:

> However when the victim has put their new address in, what happens
> then?

The way I handle it (for a web account) is:

  Upon making the request for a new email address a confirm message
  is sent to the new address (I generously assume that the password
  check verified human identity).

  Nothing is changed in their subscription status.

  Upon the URL in the confirm message being visited (this is a web
  account after all), the email address is changed (I assume that
  knowledge of the confirm token, which is an MD5 hash of a secret
  value with the new email address (which I check) indicates that
  tha new address does work).

The necessary adaption for Mailman would be adding email-reponse
confirmation.  Of course this leaves a window between request and
confirmation during which mail might go where the member doesn't
want it to go (ahem), but I'd suggest that that window is acceptably
and controllably small, especially given that 90% of it is under the
member's purview.

-- 
J C Lawrence                                       claw at kanga.nu
---------(*)                          http://www.kanga.nu/~claw/
--=| A man is as sane as he is dangerous to his environment |=--