3 ms·
> More seriously: two-factor auth is such a reasonable bare-minimum and easy-to-do (from the account-holder end) thing for account security these days that the
by clysm 4y ago
> More seriously: two-factor auth is such a reasonable bare-minimum and easy-to-do (from the account-holder end) thing for account security these days that the objections being raised make no sense to me.
As a security engineer, this is the thing I don't get about dissenters. Any account I actually care about has 2FA on it.
By today's security standards, NOT adding 2FA just means you don't really care about your project. Hand it over to someone else in that case.
- atoav 4y agoWell it depends, is the thing the second factor is meant to protect actually worthy of that level protection?
- elteto 4y agoWell, they literally thought about this! It's only required for critical packages, for whatever definition of critical they have.
- omoikane 4y agoDepends. Some websites insists on implementing 2FA in a poor way (e.g. installing dodgy custom apps on users' phones), so for accounts that users really care about, it might be the case that they would avoid these poor implementations to reduce attack surface. (I am sure it doesn't apply to PyPI, but I am just saying both site operators and users need to adopt best practices in terms of 2FA)