3 ms·

They've been offering people hardware keys for free. https://pypi.org/security-key-giveaway/ https://pypi.org/security-key-giveaway/

Wowfunhappy 4y ago
That's a great initiative, but I expect the maintainers who are interested to be the ones who've already turned on (some lesser form of) 2FA voluntarily. Anyone who is turning on 2FA because of this requirement is going to select the most frictionless method of complying with the mandate. Which will not be a hardware key.
- staticassertion 4y ago
  OK? So more people use TOTP and there's a marginal security win. And maybe a few use a token, and there's a significant win.
  - Wowfunhappy 4y ago
    TOTP is a minuscule security win in exchange for a significant amount of inconvenience, versus using a good password manager. If you want to prevent password reuse, add an option to use a pre-generated password as an alternative to 2FA. I think the statement "these weaknesses are implementation specific", while true, is irrelevant when 99% of people affected by this mandate (and 99.9% of 2FA users in general) are going to use an implementation with these weaknesses. And, I think it really sucks that PyPI is loosing maintainers due to a policy that won't increase security in a meaningful way.
    - staticassertion 4y ago
      The difference between a password manager and TOTP is that TOTP is something PyPI can enforce and a password manager is not. Yes, TOTP adds very little advantage when you have an already safe password. But there is no way for PyPI to know if you're doing that or not, and they can know if you're using 2FA. > 99% of people affected by this mandate (and 99.9% of 2FA users in general) are going to use an implementation with these weaknesses Time will tell. PyPI is giving away free keys, presumably to encourage adoption of the safer option. I'm actually very happy to see maintainers go. If they weren't willing to enable 2FA I worry about what other issues their software poses.
      - Wowfunhappy 4y ago
        > Yes, TOTP adds very little advantage when you have an already safe password. But there is no way for PyPI to know if you're doing that or not. But there is! Pre-generate a password for the user, instead of letting them supply one. This adds no extra inconvenience if you're already using a password manager, but it makes password reuse impossible.
        staticassertion 4y ago
        So make a proposal for them to do that.
        Wowfunhappy 4y ago
        Okay, this is me proposing it! :) I'm not the first person to come up with this idea. I think if PyPI had taken the approach of "here are our concerns, here is what we're protecting, here are some different options to make this work in the most convenient way possible", that would have been received very differently. Instead, they issued an ultimatum.
        staticassertion 4y ago
        I think you'll find that in the course of making an actual formal proposal there are more caveats than you might imagine, and not necessarily as many upsides. For example, just off the top of my head; 2FA as a general solution allows for U2F, which is significantly safer than your solution, even if it also allows for TOTP, which is "only" as safe as your solution. It's also a change in user experience. Migrating users with existing passwords over to these new passwords may be more difficult for any number of reasons. That's just a few seconds of thought. A real proposal might explicitly address these concerns. Like I said, feel free to make that proposal. A post on HN is not going to cut it, and it isn't going to help anyone. If you want to be more involved in how PyPI is maintained I suggest you do so.

Wowfunhappy 4y ago

That's a great initiative, but I expect the maintainers who are interested to be the ones who've already turned on (some lesser form of) 2FA voluntarily. Anyone who is turning on 2FA because of this requirement is going to select the most frictionless method of complying with the mandate. Which will not be a hardware key.

staticassertion 4y ago
OK? So more people use TOTP and there's a marginal security win. And maybe a few use a token, and there's a significant win.
- Wowfunhappy 4y ago
  TOTP is a minuscule security win in exchange for a significant amount of inconvenience, versus using a good password manager. If you want to prevent password reuse, add an option to use a pre-generated password as an alternative to 2FA. I think the statement "these weaknesses are implementation specific", while true, is irrelevant when 99% of people affected by this mandate (and 99.9% of 2FA users in general) are going to use an implementation with these weaknesses. And, I think it really sucks that PyPI is loosing maintainers due to a policy that won't increase security in a meaningful way.
  - staticassertion 4y ago
    The difference between a password manager and TOTP is that TOTP is something PyPI can enforce and a password manager is not. Yes, TOTP adds very little advantage when you have an already safe password. But there is no way for PyPI to know if you're doing that or not, and they can know if you're using 2FA. > 99% of people affected by this mandate (and 99.9% of 2FA users in general) are going to use an implementation with these weaknesses Time will tell. PyPI is giving away free keys, presumably to encourage adoption of the safer option. I'm actually very happy to see maintainers go. If they weren't willing to enable 2FA I worry about what other issues their software poses.
    - Wowfunhappy 4y ago
      > Yes, TOTP adds very little advantage when you have an already safe password. But there is no way for PyPI to know if you're doing that or not. But there is! Pre-generate a password for the user, instead of letting them supply one. This adds no extra inconvenience if you're already using a password manager, but it makes password reuse impossible.
      - staticassertion 4y ago
        So make a proposal for them to do that.
        Wowfunhappy 4y ago
        Okay, this is me proposing it! :) I'm not the first person to come up with this idea. I think if PyPI had taken the approach of "here are our concerns, here is what we're protecting, here are some different options to make this work in the most convenient way possible", that would have been received very differently. Instead, they issued an ultimatum.
        staticassertion 4y ago
        I think you'll find that in the course of making an actual formal proposal there are more caveats than you might imagine, and not necessarily as many upsides. For example, just off the top of my head; 2FA as a general solution allows for U2F, which is significantly safer than your solution, even if it also allows for TOTP, which is "only" as safe as your solution. It's also a change in user experience. Migrating users with existing passwords over to these new passwords may be more difficult for any number of reasons. That's just a few seconds of thought. A real proposal might explicitly address these concerns. Like I said, feel free to make that proposal. A post on HN is not going to cut it, and it isn't going to help anyone. If you want to be more involved in how PyPI is maintained I suggest you do so.