3 ms·
While I can see the merit in discussing the issue of where to store the second factor, what I see much less often discussed is the story on the "tooling" side.
by vladvasiliu 3y ago
While I can see the merit in discussing the issue of where to store the second factor, what I see much less often discussed is the story on the "tooling" side.
For example, on PyPI, to upload stuff, you need to generate a token. Now you have effectively a single factor, which requires as much care as a regular password.
- di 3y agoThis is why PyPI recommends using Trusted Publishing (https://docs.pypi.org/trusted-publishers/ https://docs.pypi.org/trusted-publishers/) which removes the need for long-lived tokens entirely.