If you have originally rolled out the site initially with that option turned off, the usernames would not change to an e-mail automatically if you decide to turn it on later. However, the user would still be able to login to the site with username or e-mail.

The reason that the system does not automatically change their username, is primarily because not everyone is aware that they are required to use their e-mail. If you decide to just switch it on, they will not be able to login with their existing username.

Yes I see.

But if the option is activated from the start, it means that the user can connect with the email address given at registration and also with the new email address.
Does not this create a security breach ? If his address is in the meantime ceded to someone else ?

Thank you Mark
Philippe

Not sure where you are going with this but if you edit your profile and enter a new e-mail, your username would then be the e-mail address that you have changed to.

Yes it's correct.
But the user (or someone else) will be able to connect with the original Joomla username (original email address)...

In my humble opinion, if "Use Email as Username" is activated: this Joomla username should also be updated. That would make sense.
To avoid problems in the long term.
And avoid identity theft.

Imagine if the email address is attached to a personal domain name.
myenterprise.com for example.
And later, the domain myenterprise.com is abandoned.
A person will be able to bought the domain, and then simply reset the password for the account EasySocial.

In addition, I do not think it is honest to keep his original email address, while the user has decided to change it.
I opened this post in connection with the GDPR.

Thank you Mark
Philippe

I see, I get your point now. I have logged this into our issue tracker.

Thank you very much Mark for your understanding.
It is better to anticipate.

Philippe

No problem