Changed email address but my OVO Forum Messages are still sent to old address

Hi ​@PJW ,

OVO Forum accounts are not currently linked to your OVO account at all - they’re deliberately kept separate and don’t interact with each other. Creation of one does not create the other.

If you’d like to update the email address for your Forum account, please send an email from the old email address to forum@ovoenergy.com with your request and mention the email address you want to switch to.

A Forum Moderator will be able to help with that once they pick it up.

Hope that helps!

From what I remember, for creating this forum account you need to register separately from your energy account. I assume, that some people would use the same details for keeping things easier. It’s probably why you think it propagated the email address from your energy account. 

Interesting. How can I tell what the old email address is since there’s no mention of it in the profile?

The one you use to login to the forum. You probably also receive some email notifications to that email address.

But I’m always signed in, which is why I can’t remember what the address is. And when they introduced the ‘notification centre’ 🔔 I quickly learnt to cancel all notifications to avoid getting most of the entries there. I don’t understand why the username isn’t shown in the profile, even if it’s read-only.

Isn’t it your responsibility to know which email address you are registering under? I agree, it’s good to see your email address in your profile. But, if you can forget it – write it down. Also, technology these days can remember it for you.

​@PJW Thanks for the post and getting some engagement going around this - great question. 

Thanks to ​@Blastoise186 & ​@Abby_OVO for providing you with the best way to reach out in order to update your email address regarding your forum account.

Once updated to the prefered email address (removing the old one), you will be able to login normally, with the same existing password, whether you choose to sign in using your new email address or forum username!

Also, an update for any of our users that would like to see the email they originally registered when signing up to the forum (Like our friendly neigbourhood super user ​@Firedog) - I’ve now added a private ‘User Profile Field’ where you can enter the email address you’re using with the forum (As you currently cannot see this via any current ‘Profile’ setting).

This is completely private and can only be viewed by yourself and the OVO moderators (Which we can see anyway) behind the scenes.

Hopefully, this is useful to some of you who may easily forget over time and have chosen not to recieve email notifications from us!

You’ll see that our omnipotent ruler has made it possible for you to record the email address you’re currently using as the username for the forum account on the profile page. This is good for those who forget things (🙋🏻), but it would IMO be better if this field were automatically filled from the stored forum account details so that it was read-only as well as private.  Changing it currently still needs manual intervention from forum admin, but automating a change could be made possible simply by requiring the user wanting to change to be signed in to the energy account - a little cookie check. 

Whilst I have no doubt that Gainsight could implement such a cookie check etc. the question is whether they would.

They do for some unexplained reason apppear to have an aversion to letting users change their own email address. (I'm sure they must have a reason but unless it's Gainsight software specific I can't fathom it).

The only way that could work at all would be via Single Sign-On and/or the inSided API.

OVO has already stated somewhere previously that they weren’t ready to do that for the Forum yet.

Just compare the cookies stored by this site (a) when you’re not signed in to the energy account, and (b) when you are. I’ve commented on this cross-pollination of cookies before. GS can tell whether you’re signed in or not, and even what your OVO account number is. 

While viewing this page, and while you’re signed in to your OVO energy account, paste this into your browser address bar:
  

javascript:function getCookie(name) {var value = '; ' + document.cookie;var parts = value.split('; ' + name + '=');if (parts.length == 2) return parts.pop().split(';').shift();}alert("You are signed in to OVO account no. " + getCookie('selectedAccountId'));

The browser might refuse to run script like this, e.g. by removing the javascript: prefix. I just put it back and tried again:
  

That would be massively insecure. I don’t think Gainsight could even do it that way because of web restrictions. Your code is also broken - no parts of OVO infrastructure serve your account number as a plaintext cookie.

There’s no way the Forum could have scraped your account number like that. Only the site that sets the cookie, can read that cookie back has been a strict rule since day 1.

Doesn’t my screenshot illustrate that the forum can indeed retrieve my account number? 
  

But that’s the point I’m making:

1. As soon as I sign in, this session cookie is set on the ovoenergy.com domain:
     

   

    

2. My code can’t be broken if it can retrieve this cookie. It should be trivial for Gainsight to check that one of the ovoenergy.com cookies set on sign-in exists before allowing a forum account username (email address) to be changed by the user. 
   
    

[Apologies to ​@PJW  for taking his thread so far off-course. If this is all too boring or abstruse, please just ignore our chit-chat.]  

That didn’t come from the Forum - it came from a third-party cookie so the Forum can’t see it.

Hey ​@Firedog 

I’ve had to remove the screenshots as they have got your account number and we don’t want that shared all across the Forum. 

Blastoise has left some good advice here already. I would add, it’s not possible for Gainsight to know anything about OVO accounts unless it’s been provided on the Forum, the Forum platform is in no way linked to any other OVO system to gain that data.

I wonder if it’s coming from the forum profile information when you signed up. There’s a similar private box to the email one Bradley added, where you can provide you account number, so I would assume it’s come from there? If you click into ‘My Profile’, you should be able to see if you’ve got it in there. You can also edit your profile there if you wish to remove it. 

It is a private function so only yourself, and us moderators can see that. 

So it’s all right for a third party (who?) to see my OVO energy account no., but it’s not all right for the forum platform to check whether a particular cookie exists at the forum site? Isn’t that a bit odd?

.ovoenergy.com is hardly a ‘third party’. It’s the parent domain of both forum.ovoenergy.com and account.ovoenergy.com, which is why the browser allows them to share cookies, the point I’ve been trying to make. It’s possible that not everyone will see the selectedAccountID cookie, but the account no. is available nonetheless as one of the elements in the main MixPanel cookie. Please have a look.

I’m not sure what is so insecure about subdomains sharing cookies (and I don’t understand why I’m not allowed to show my account no. here). I clearly have a lot to learn about forum security.