4 ms·

> What can I do to prepare? > > The most important things you can do to prepare are to enable 2FA for your account as soon as possible, either with a security

> What can I do to prepare? > > The most important things you can do to prepare are to enable 2FA for your account as soon as possible, either with a security device (preferred) or an authentication app and to switch to using either Trusted Publishers (preferred) or API tokens to upload to PyPI. So you either need to have a mobile phone (all of the linked applications[0] seem to require an Android or iOS device) or some custom device and they prefer you to rely on some 3rd party they call "Trusted Publisher"? Weren't private+public key signatures invented for solving pretty much this thing? They might be a bit complex for Mere Mortals but programmers should at least be able to figure them out. Am i missing something? EDIT: seems like TOTP is indeed similar to private+public key signatures (in that there is a shared secret to check against), can be done fully locally without requiring a phone or any 3rd party service and it just happened that the applications listed on the site were all for phones. [0] https://pypi.org/help/#totp https://pypi.org/help/#totp

jjgreen 3y ago
Bummer, better delete my packages before I get locked out for good then.
- eesmith 3y ago
  If you delete your package, can't someone else grab the namespace? I see that as the main issue if you want to migrate away from PyPI's management practices. Similarly, if you don't want to deal with PyPI at all, and host your own packages, then it's all too easy for someone else to register a package of the same name on PyPI. Users aren't used to configuring an alternate server.
  - jjgreen 3y ago
    Very possibly, but I don't have a phone or a hardware key, and I'm certainly not going out and getting one for the benefit of PyPI, so my choices are? Having an outdated version of my packages on a locked-out account on PyPI (with the up-to-date sdists that I distribute on my website) sounds like a nightmare.
    - multani 3y ago
      There's a number of offline, opensource, TOTP CLI applications, so just use one of them for instance?
      - jjgreen 3y ago
        Those can be used? That could be a way around this then, thanks -- I'll investigate (just going on @badsectoracula's comment that phone or key is required, possibly I misinterpreted that). Still something of a PITA though (and not really a second factor).
        arcanemachiner 3y ago
        KeepassXC is great. Just keep a copy of your .kbdx file synced to a backup location.
    - vasachi 3y ago
      Well, that is your right as an owner of the packages. By the way, what are those packages?
      - jjgreen 3y ago
        Some low-traffic maths stuff I made for myself (but others are welcome to use): https://pypi.org/user/jjg/ https://pypi.org/user/jjg/
    - dalke 3y ago
      I also don't have a smart phone or hardware key, and feel the same. I host my packages on my own server using the PEP 503 "Simple Repository API". (For what it's worth, Donald Stufft, author of this PyPI blog post, also wrote PEP 503.) I migrated away from PyPI years ago because modern FOSS distribution is increasingly intermediated by package managers, which I think worsens the connection between user and producer by adding a layer of anonymity. I see 2FA as a technical work-around using mechanical trust instead of personal trust. I don't care if people who don't know about me or my project web site can't find it on PyPI, because care is reciprocal - I want them to care about me too, at least enough to know where the project came from. That's where I think trust comes from. My packages will never be popular. I develop very specialized software for a field with perhaps 10,000 world-wide users. No one will pay for my software, or hire my services, if they only visit PyPI. I thankfully still have a Python 2.7 version of my software on PyPI. I haven't deleted it, to make name-squatting harder. It's even lead people to contact me directly, to ask about Python 3 support. I never would have heard from them, had I published the newest versions on PyPI, and that direct contact breaks the anonymity PyPI interposes. A nice plus is how hosting means I have full access to the download logs, giving me insight onto what platforms people use that PyPI doesn't provide, because "anonymity". The biggest annoyance is they main reason I started using PyPI was because someone else added another project of mine to PyPI. I distributed https://pypi.org/project/PyRSS2Gen/ https://pypi.org/project/PyRSS2Gen/ on my own web site as source. Someone else added it to PyPI, with me listed as the primary developer. I didn't know about it until the PyPI devs emailed developers like me to encourage them to support Python 3! I then had to ask that stranger for access to the PyPI entry. I fear that will happen again, if I ever develop a new package that I distribute myself. I hope this provide something for you to chew on, as you consider what you might do.
ztlpart 3y ago
[flagged]
- zoobab 3y ago
  Megacorps representative has hijacked most of the foss foundations, especially in the US.
BoppreH 3y ago
Not at all, you can use any TOTP app and the list does include desktop options. I like https://authy.com/ https://authy.com/ , from Twilio, and use it both on my desktop and phone. I've started using it to enable TOTP backup/syncing, and I've been using it for PyPI 2FA for years now. Or you can implement your own, TOTP is not complicated. Here's a Python library that does the heavy lifting for you: https://github.com/pyauth/pyotp https://github.com/pyauth/pyotp .
- dizzy3gg 3y ago
  That’s a third party.
  - BoppreH 3y ago
    The parent was complaining about needing "either [...] a mobile phone [...] or some custom device", which is not true. And sure, Authy is a third-party; but it's not the only option, and you can implement your own (TOTP is not that complicated). And TOTP has much better user experience than raw keys, especially for beginners who might mix the public/private parts, and experts who want hardware protection.
    - badsectoracula 3y ago
      Actually my main concern is the reliance on 3rd parties - requiring a mobile phone is an implicit reliance on a lot of 3rd parties that IMO should not have any business where/how i authenticate myself. I don't know about TOTP but if it can be completely independent from 3rd parties and can be used locally like private+public key signatures can then i guess it is fine.
      - eesmith 3y ago
        "TOTP for 2FA is incredibly easy to implement. So what's your excuse?" shows how to do it in Python. https://drewdevault.com/2022/10/18/TOTP-is-easy.html https://drewdevault.com/2022/10/18/TOTP-is-easy.html . Though Python would be a 3rd party dependency. ;) HN comments about that article at https://news.ycombinator.com/item?id=33245042 https://news.ycombinator.com/item?id=33245042 . Including some of the problems people have had with 2FA usability.
proto_lambda 3y ago
It's TOTP, a very simple and universal standard, you can use any application you want - many password managers support it as well.
arp242 3y ago
You can implement TOTP in a few lines of code; it's pretty straightforward and there's many CLI and desktop apps, plugins for (desktop) password managers, etc. For some reason many sites seem to pretend it's a phone- or special device only thing. In principle it's more secure, but if you also have a password manager on your phone – as many people do – then it's not really.
- badsectoracula 3y ago
  Does TOTP rely on some external service though or can it be done fully locally? AFAIK a benefit of private+public key signatures is that it can all be done without reliance on 3rd parties.
  - proto_lambda 3y ago
    All it requires is the initial setup key and a somewhat accurate (~30s) time source. Give https://en.wikipedia.org/wiki/Time-based_one-time_password#Algorithm https://en.wikipedia.org/wiki/Time-based_one-time_password#A... a read, it's extremely simple.
    - badsectoracula 3y ago
      Thanks, i took a look in the page and it looks quite simple. One question i have would be that it mentions: > TOTP credentials are also based on a shared secret known to both the client and the server AFAICT this "shared secret" is something that is shared between the service you want to authenticate with (e.g. PyPI) and "you" (your password manager, TOTP client or whatever), right? In which case i guess this sounds something like it can be done fully locally indeed.
      - proto_lambda 3y ago
        Yes, I don't know of any TOTP authenticator that doesn't work fully locally (disregarding things like key backups).
hcrean 3y ago
python3 -c "import pyotp ; print(pyotp.TOTP(\"<My secret token>\".lower()).now())" This code snippet can be used for standard TOTP 2FA
tomschwiha 3y ago
I'm using https://github.com/Spomky-Labs/otphp https://github.com/Spomky-Labs/otphp to generate in a PHP Backend automatically TOTPs. Something similiar is probably also available for Python/Javascript/etc.
CodesInChaos 3y ago
TOTP is effectively a cryptographic hash(shared-secret, time) producing 6 decimal digits where time gets incremented every 30s. The server accepts the token if it's recent enough. Many desktop password managers have built in support (e.g. keepass2).
donaldstufft 3y ago
TOTP is a good choice, and helps a lot on keeping everyone's account safe! Thanks a lot for taking the time to investigate your options I do feel want to mention though (largely because I think it's pretty cool), that those security devices are using a private/public key system under the covers, and they're actually designed to be privacy friendly and phishing resistant. One of the problems with TOTP based 2FA is that since it's asking users to type the TOTP code into the website, they can be phished and tricked into typing their password and TOTP code into an attacker's website, who then quickly go and use it to sign onto their account. Those hardware tokens prevent that phishing from happening. They basically create, on the fly, a public/private key pair that is bound to the domain name of the site in question, and then give the public key of that to the site. When you come back to log in again, the site tells the hardware token what public key it has, the token looks a the site's domain and determines if it has that key for that domain, and if it does it uses a signature to prove ownership of the private key. It all ends up working really well, since the domain name (actually the protocol, domain name, and port) is part of the identify of the key pair, it is impossible for it to get entered on the wrong site, so it completely eliminates phishing. Then since every single site gets it's own brand new keypair generated for it, there's no way to determine that the hardware token used on Site A is the same as the hardware token used on Site B. So it's entirely privacy preserving as well! The protocol is obviously a bit more complicated then that, but that's the general idea of it.

jjgreen 3y ago

Bummer, better delete my packages before I get locked out for good then.

eesmith 3y ago
If you delete your package, can't someone else grab the namespace? I see that as the main issue if you want to migrate away from PyPI's management practices. Similarly, if you don't want to deal with PyPI at all, and host your own packages, then it's all too easy for someone else to register a package of the same name on PyPI. Users aren't used to configuring an alternate server.
- jjgreen 3y ago
  Very possibly, but I don't have a phone or a hardware key, and I'm certainly not going out and getting one for the benefit of PyPI, so my choices are? Having an outdated version of my packages on a locked-out account on PyPI (with the up-to-date sdists that I distribute on my website) sounds like a nightmare.
  - multani 3y ago
    There's a number of offline, opensource, TOTP CLI applications, so just use one of them for instance?
    - jjgreen 3y ago
      Those can be used? That could be a way around this then, thanks -- I'll investigate (just going on @badsectoracula's comment that phone or key is required, possibly I misinterpreted that). Still something of a PITA though (and not really a second factor).
      - arcanemachiner 3y ago
        KeepassXC is great. Just keep a copy of your .kbdx file synced to a backup location.
  - vasachi 3y ago
    Well, that is your right as an owner of the packages. By the way, what are those packages?
    - jjgreen 3y ago
      Some low-traffic maths stuff I made for myself (but others are welcome to use): https://pypi.org/user/jjg/ https://pypi.org/user/jjg/
  - dalke 3y ago
    I also don't have a smart phone or hardware key, and feel the same. I host my packages on my own server using the PEP 503 "Simple Repository API". (For what it's worth, Donald Stufft, author of this PyPI blog post, also wrote PEP 503.) I migrated away from PyPI years ago because modern FOSS distribution is increasingly intermediated by package managers, which I think worsens the connection between user and producer by adding a layer of anonymity. I see 2FA as a technical work-around using mechanical trust instead of personal trust. I don't care if people who don't know about me or my project web site can't find it on PyPI, because care is reciprocal - I want them to care about me too, at least enough to know where the project came from. That's where I think trust comes from. My packages will never be popular. I develop very specialized software for a field with perhaps 10,000 world-wide users. No one will pay for my software, or hire my services, if they only visit PyPI. I thankfully still have a Python 2.7 version of my software on PyPI. I haven't deleted it, to make name-squatting harder. It's even lead people to contact me directly, to ask about Python 3 support. I never would have heard from them, had I published the newest versions on PyPI, and that direct contact breaks the anonymity PyPI interposes. A nice plus is how hosting means I have full access to the download logs, giving me insight onto what platforms people use that PyPI doesn't provide, because "anonymity". The biggest annoyance is they main reason I started using PyPI was because someone else added another project of mine to PyPI. I distributed https://pypi.org/project/PyRSS2Gen/ https://pypi.org/project/PyRSS2Gen/ on my own web site as source. Someone else added it to PyPI, with me listed as the primary developer. I didn't know about it until the PyPI devs emailed developers like me to encourage them to support Python 3! I then had to ask that stranger for access to the PyPI entry. I fear that will happen again, if I ever develop a new package that I distribute myself. I hope this provide something for you to chew on, as you consider what you might do.

ztlpart 3y ago

[flagged]

zoobab 3y ago
Megacorps representative has hijacked most of the foss foundations, especially in the US.

BoppreH 3y ago

Not at all, you can use any TOTP app and the list does include desktop options. I like https://authy.com/ https://authy.com/ , from Twilio, and use it both on my desktop and phone. I've started using it to enable TOTP backup/syncing, and I've been using it for PyPI 2FA for years now. Or you can implement your own, TOTP is not complicated. Here's a Python library that does the heavy lifting for you: https://github.com/pyauth/pyotp https://github.com/pyauth/pyotp .

dizzy3gg 3y ago
That’s a third party.
- BoppreH 3y ago
  The parent was complaining about needing "either [...] a mobile phone [...] or some custom device", which is not true. And sure, Authy is a third-party; but it's not the only option, and you can implement your own (TOTP is not that complicated). And TOTP has much better user experience than raw keys, especially for beginners who might mix the public/private parts, and experts who want hardware protection.
  - badsectoracula 3y ago
    Actually my main concern is the reliance on 3rd parties - requiring a mobile phone is an implicit reliance on a lot of 3rd parties that IMO should not have any business where/how i authenticate myself. I don't know about TOTP but if it can be completely independent from 3rd parties and can be used locally like private+public key signatures can then i guess it is fine.
    - eesmith 3y ago
      "TOTP for 2FA is incredibly easy to implement. So what's your excuse?" shows how to do it in Python. https://drewdevault.com/2022/10/18/TOTP-is-easy.html https://drewdevault.com/2022/10/18/TOTP-is-easy.html . Though Python would be a 3rd party dependency. ;) HN comments about that article at https://news.ycombinator.com/item?id=33245042 https://news.ycombinator.com/item?id=33245042 . Including some of the problems people have had with 2FA usability.

proto_lambda 3y ago

It's TOTP, a very simple and universal standard, you can use any application you want - many password managers support it as well.

arp242 3y ago

You can implement TOTP in a few lines of code; it's pretty straightforward and there's many CLI and desktop apps, plugins for (desktop) password managers, etc. For some reason many sites seem to pretend it's a phone- or special device only thing. In principle it's more secure, but if you also have a password manager on your phone – as many people do – then it's not really.

badsectoracula 3y ago
Does TOTP rely on some external service though or can it be done fully locally? AFAIK a benefit of private+public key signatures is that it can all be done without reliance on 3rd parties.
- proto_lambda 3y ago
  All it requires is the initial setup key and a somewhat accurate (~30s) time source. Give https://en.wikipedia.org/wiki/Time-based_one-time_password#Algorithm https://en.wikipedia.org/wiki/Time-based_one-time_password#A... a read, it's extremely simple.
  - badsectoracula 3y ago
    Thanks, i took a look in the page and it looks quite simple. One question i have would be that it mentions: > TOTP credentials are also based on a shared secret known to both the client and the server AFAICT this "shared secret" is something that is shared between the service you want to authenticate with (e.g. PyPI) and "you" (your password manager, TOTP client or whatever), right? In which case i guess this sounds something like it can be done fully locally indeed.
    - proto_lambda 3y ago
      Yes, I don't know of any TOTP authenticator that doesn't work fully locally (disregarding things like key backups).

hcrean 3y ago

python3 -c "import pyotp ; print(pyotp.TOTP(\"<My secret token>\".lower()).now())" This code snippet can be used for standard TOTP 2FA

tomschwiha 3y ago

I'm using https://github.com/Spomky-Labs/otphp https://github.com/Spomky-Labs/otphp to generate in a PHP Backend automatically TOTPs. Something similiar is probably also available for Python/Javascript/etc.

CodesInChaos 3y ago

TOTP is effectively a cryptographic hash(shared-secret, time) producing 6 decimal digits where time gets incremented every 30s. The server accepts the token if it's recent enough. Many desktop password managers have built in support (e.g. keepass2).

donaldstufft 3y ago

TOTP is a good choice, and helps a lot on keeping everyone's account safe! Thanks a lot for taking the time to investigate your options I do feel want to mention though (largely because I think it's pretty cool), that those security devices are using a private/public key system under the covers, and they're actually designed to be privacy friendly and phishing resistant. One of the problems with TOTP based 2FA is that since it's asking users to type the TOTP code into the website, they can be phished and tricked into typing their password and TOTP code into an attacker's website, who then quickly go and use it to sign onto their account. Those hardware tokens prevent that phishing from happening. They basically create, on the fly, a public/private key pair that is bound to the domain name of the site in question, and then give the public key of that to the site. When you come back to log in again, the site tells the hardware token what public key it has, the token looks a the site's domain and determines if it has that key for that domain, and if it does it uses a signature to prove ownership of the private key. It all ends up working really well, since the domain name (actually the protocol, domain name, and port) is part of the identify of the key pair, it is impossible for it to get entered on the wrong site, so it completely eliminates phishing. Then since every single site gets it's own brand new keypair generated for it, there's no way to determine that the hardware token used on Site A is the same as the hardware token used on Site B. So it's entirely privacy preserving as well! The protocol is obviously a bit more complicated then that, but that's the general idea of it.