3 ms·
>PyPI is proactively considering critical packages without 2FA protection malicious And it's ridiculous for them to do so. How can they verify that the 2FA pro
by cowtools 4y ago
>PyPI is proactively considering critical packages without 2FA protection malicious
And it's ridiculous for them to do so. How can they verify that the 2FA program is not just being run in a virtual machine? At the end of the day it's the maintainer that decides the security of the package.
- striking 4y agoYou appear to have a fundamental misunderstanding of the 2FA in this case. TOTP-based 2FA is available for PyPI, for which any number of FOSS freely-runnable clients are available. See also https://pypi.org/help/#totp https://pypi.org/help/#totp
- josephcsible 4y agoI think GP is actually saying that there's no way to prove that users aren't storing their TOTP secrets in a way that defeats the purpose of 2FA, such as right next to their passwords in cleartext.
- woodruffw 4y agoThis is why we encourage WebAuthn by default (and why PyPI is giving out free security keys): it’s much more misuse-resistant. Ultimately, PyPI cannot prevent TOTP secret misuse. But we expect the overwhelming majority of users to not misuse TOTP, and a corresponding security advantage therefrom.