Password Reset Security Flaw

[Laraul]

If you attempt logging into the game from a different location without a security token(aka one-time password), you are told that you must reset your password with an email sent to you containing a link that allows you to do so. But this applies only when logging onto the game, not your Square Enix Account Management System.

It's possible to login to a persons Square Enix Account thru the management system, change the password, then use that password to login w/o triggering the automatic password reset do to logging in from a different location. Also, you do not receive an email when changes to your account, including the password.

Not everyone has a security token or a device able to use one. And a lot of people won't use a token since it's a hassle. And anyone would expect to be notified when ANY change to my account is made.