> -1 to this. while 2FA is a no-brainer for most of us, publicly listing (or showing status) not only encroaches individual liberty to make a choice, it would

> -1 to this. while 2FA is a no-brainer for most of us, publicly listing (or showing status) not only encroaches individual liberty to make a choice, it would open such users to be targets of an attack. Saying that you refuse to enable 2FA is the information security equivalent of saying you refuse to wear a condom. Of course people are free to make their own choices but I personally wouldn't take anyone who publishes software seriously if it's not enabled. This isn't like securing access to a social media or shopping account. The ramifications of a breach can quickly cascade and 2FA is low hanging fruit to stop a lot of that. It's far from perfect but it goes a long way. > Enforcing 2FA in an organization seems more appropriate. Perhaps npmjs.com has implemented that since last I looked, but I know in the past that enforcement was not available. The nested nature of dependencies makes partial enforcement pointless: A (2FA) > B (2FA) > C (2FA) > D (no 2FA!) > I also greatly dislike the trend of public "shaming" that's so prevalent today. The internet has made us cruel. I wholeheartedly agree with you on both points and, outside of security, I can't think of any other example where I'd be open to it. I like to think I hold myself and people in our own industry to higher standards than the Internet at large.