3 ms·
You appear to have a fundamental misunderstanding of the 2FA in this case. TOTP-based 2FA is available for PyPI, for which any number of FOSS freely-runnable cl
by striking 4y ago
You appear to have a fundamental misunderstanding of the 2FA in this case. TOTP-based 2FA is available for PyPI, for which any number of FOSS freely-runnable clients are available. See also https://pypi.org/help/#totp https://pypi.org/help/#totp
- josephcsible 4y agoI think GP is actually saying that there's no way to prove that users aren't storing their TOTP secrets in a way that defeats the purpose of 2FA, such as right next to their passwords in cleartext.
- woodruffw 4y agoThis is why we encourage WebAuthn by default (and why PyPI is giving out free security keys): it’s much more misuse-resistant. Ultimately, PyPI cannot prevent TOTP secret misuse. But we expect the overwhelming majority of users to not misuse TOTP, and a corresponding security advantage therefrom.