repeated auto-created accounts

[drewp]

While testing my createTwitterAccount workflow I noticed this:

1. connect a twitter account 'foo' to tipjoy
2. on the tipjoy settings, Twitter tab, 'remove' link
3. via the API, request a new connection from the same twitter account
4. the returned tipjoy account is named 'foo0'

I was expecting tipjoy to give me its already-created 'foo' account.
In fact, I don't see how the creator of the tipjoy 'foo' account could
ever log in to claim money or whatever, now that the twitter-based
authentication is pointing to the 'foo0' account.

[Ivan Kirigin]

On that step #2 to remove the twitter account, it is no longer
associated with the user.

On step #3, we check if the twitter account is associated with a user.
It isn't so we create a new one.

There is still a way to check if that twitter account has an owner
(because the Tipjoy user who gets funds sent to that twitter account
doesn't change in step #2).

I have to think about this. There could be reasons why people took
step #2, e.g. their twitter account was compromised and they don't
want their Tipjoy account compromised.


For the account sign in for 'foo', they can just use their password.
If they forgot it and have an email address in Tipjoy, they can use
the form here: http://tipjoy.com/forgotpwd

If they don't have an email address in the system, they can just contact us.

Note that most people don't remove the twitter account linked to their
Tipjoy account, so this problem is not big.

Ivan
http://tipjoy.com