On: Google’s OAuth login doesn’t protect against purchasing a failed startup domain

[horsawlarway]

So you use email/pass and the reset password email dumps right to the new party as well, because they control the MX records for the domain?

[lxgr → horsawlarway]

That's why allowing account recovery using (exclusively) email is indeed a security problem.