Hello Daniel,

I will pass it to Michael and rest of the team. I believe it was originally omitted for the simple reason that if someone is logged into your account and wants to change the password… they need to know the password to get into it in the first place. So logically if you ask them for the old one… it won’t stop them cause they already know it… otherwise how would they get inside. Nonetheless we’ll look at this.

Daniel,

I’m not sure how you would leave your computer like this… I always log out before walking away (have had way too many bed experiences with leaving my stuff unattended like this) . However I did have posted this issue to Michael and tech. I will also bring it up on our next team meeting.

Hi Daniel, While it’s not a large security flaw, we might want to re-visit it in the future. The good thing is that you can’t change your email without the old one, so even if unlikely someone changes your password, you can still regain it back with your email using our “forget your password” form. We’ll revisit this concept and see if we change it to make it more secure, but the most important thing is that having the same email address helps you maintain control over your Nozbe account and no one can take it from you. Thanks for looking into this!