MTS Update Finished

id not using email- they have to actually have your pass before they can log in and find out ur email to hack it and to switch info around

email as id- woot don't need pass just hack email, resend verification to switch infos

hmmmm anything im missing here?

Pretty much this.

Your question actually made me check the password reset system out of curiosity.
Sure enough, requesting a password reset sends my registered email address a link that I can follow to a form that simply asks me to enter a new password...
...despite the fact that I have security questions set up!!!!

So the only point of the security questions appears to be to change the information if you already have access to the account.

Just make a mule email account people o.o Not that difficult.

That's what I'd do anyway; I don't like to keep all of my proverbial eggs in one basket.
However, it would mean having another account to upkeep.

Then again, it's far easier to burn an email address than to burn an account.

Not really. Nexon's "solution" is to remove one layer of security ("by obscurity" or otherwise).

Well, it's removing a layer of obscurity in exchange for the ability to shuffle around one 'lock' as much as you wish.

Really, the threat of someone getting into your email account should be a zero-risk nowadays.
Most popular providers prevent brute-forcing and will even alert you if someone has been trying to do so.
Gmail, folks.

Plus, Nexon has made strides in obscuring who is and isn't signed up.
Try to signup for using an email address that's already registered, and the email account gets this mail:

"Greetings,

Another user has tried to register an account with the email address xxxx@xxxx.xxx. For your account security, we recommend you update your password and secondary security.

Visit the Account Settings page at anytime to update your information.

— The Nexon Team"

They also made sure the same generic statement is given when logging in with an invalid ID/email or a valid ID/email with an incorrect password.

Of course, the only exception to this rule is the Gamelauncher itself which will open up your browser to the Maplestory homepage should you try to login with an invalid ID/email.