account recovery policy, FAQ, and tooling

[brainwane]

If a user says that they are having trouble recovering their password (because they don't have access to that email address anymore, or because they signed up before PyPI required an email address),

• What's our policy on helping them, and what's our policy on verifying their claim?
• Right now requests for help on this go to the SourceForge support queue. OK to add an item to https://pypi.org/help/ pointing people there? (Someone with this problem just showed up in #pypa not knowing where else to turn.)
• Do Warehouse administrators want better tooling for account recovery?

[brainwane]

I believe this does need addressing before launch, so I'm keeping it in this milestone.

[brainwane]

I've made #3190 to add a note about account recovery to the FAQ, and we discussed this in today's core Warehouse developers meeting.

What's our policy on helping users who ask for account recovery, and what's our policy on verifying their claim?: We do these investigations (claims to names) on a case-by-case basis. We generally ask a person to prove they have or had the domain in question, project page, etc. Sometimes we'll ask someone to make a commit to the repo and include a particular hash or keyword in the commit/commit message.

Do Warehouse administrators want better tooling for account recovery? For the actual changing of a user's email address in Warehouse, no. But #3176 would be nice to check mail deliverability (that'd help us see if mail is bouncing), and I've filed #3231 to establish separate support queue for customer support.

I'm calling this closed since my question is answered.