News for hackers. Stuff that matters.

A comment on Compromising Angular via expired NPM publisher email domains. Parent comment

Re:Compromising Angular via expired NPM publisher email domains by codingkev on Sunday February 20, 2022 @05:13PM (#30409753)
What do you suggest as an alternative to password reset based on the account email?
[ Parent | on HN ]
Re:Compromising Angular via expired NPM publisher email domains by tedunangst on Sunday February 20, 2022 @05:17PM (#30409782)
If you retired the email because the domain expired, maybe don't let it reset existing accounts. It's dead.
[ Parent | on HN ]