Send confirmation when email address changed

[edmorley]

Currently on PyPI, if a user changes their contact email address, there is no notification to the old email address, meaning account compromise can go unnoticed.

This means that an attacker can silently prevent other important security notifications (eg #997) from being sent to the real owner.

[brainwane]

Thanks for another great suggestion, @edmorley, and sorry for the slow response!

This would be a very useful security feature, and now that #2898 is written and merged, it's far easier to add this feature.

Today in our development meeting we discussed where this should go on our development roadmap.

Since this feature isn't something that legacy PyPI has, I've moved the issue to a future milestone. But that doesn't have to stop a volunteer from working on it now; if someone wants to write up a pull request for it, go ahead!

Thanks and sorry again for the wait.

[waseem18]

I think we should send an email whenever an

• email is added
• email is deleted
• email has been changed to primary email

[waseem18]

@brainwane I'm looking into this and will soon put up a PR.

[di]

@waseem18 We already send an email when a new address is added (the "verification" email). I don't think deleting an email should require a notification, most likely the address will be unused/invalid anyways, and a "primary change" action is the one with real security implications, so I think this issue is good. Thanks for your work!

[waseem18]

Your welcome @di :)