Allow users to change their account email address

[zaach]

Users should be able to change their account email address to prevent them from getting locked out if they forget their password and lose access to their old email account.

This depends on: mozilla/fxa-auth-server#489

@ryanfeeley has the UX for this.

/cc @eoger

[zaach]

@ryanfeeley post the mockups here when you get a chance.

[ryanfeeley]

https://www.lucidchart.com/documents/view/9c9a4647-615f-4b7c-a4db-71ae10afcd04

[shane-tomlinson]

@zaach - Can you explain more about the need for this feature? Which password is being forgot in this scenario, the email provider password?

[shane-tomlinson]

Also, we have to ensure reliers do not depend on the user's email address as the unique identifier, or else the user's relier account will be inaccessible.

[shane-tomlinson]

Finally, how will this interact with a user who has a Sync session? Any session for that matter, will changing an email address invalidate all outstanding session tokens?

[ryanfeeley]

Hi Shane: email addresses are not permanent for all users, therefore we should allow users to change their email. If we don't there will be a small portion of forgetful users who will be unable to log in.

[ckarlof]

Next steps are to break down the work for this with a github checklist.

[ckarlof]

@eoger, I believe we're using the WIP label for work-in-progress PRs. When you're ready to start this self-assign, and move into waffle:in progress.

[ryanfeeley]

@ckarlof @eoger @shane-tomlinson @zaach I am starting to think that we should first require that users verify their original email address as part of the process. Would be more secure for people who still control over their original email, but the downside is that for users who lost control over their original email address, they would not be able to regain control.

[billmaggs]

I think that's an easy one; most people will still control their email account, and for those people who have lost control of what is probably a principal email account, they've probably got bigger problems than losing access to Sync data.

[ryanfeeley]

@rfk A few on social media still ask about this.

• https://twitter.com/deshpandesuraj/status/656419408881975296
• https://twitter.com/ahtmly2k/status/666361808458924033
• https://twitter.com/ade_fatality/status/695751417940738048
• https://twitter.com/KevinDemsi/status/636689643023437824

[shane-tomlinson]

This is FxA-28 on Aha, closing here.