HNGlance

Top Best New Show

PyPI: Preventing Domain Resurrection Attacks

https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/

by miketheman • 11 months ago

5 2 11 months ago

BL

Related Stories

Loading related stories...

Comments

2

miketheman• 11 months ago

PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets.

Dunedan• 11 months ago

If your PyPI account only has a single verified email address from a custom domain name,add a second verified email address from another notable domain (e.g. Gmail) to your account.

Isn't that just increasing the attack surface for all account holders following that suggestion for all cases but domain expiry?

Source preview

blog.pypi.org

HNGlance

© 2024-2026 HN Glance. Story content belongs to its original sources.

Privacy
Terms