3 ms·
I'm very excited to see 2FA become mandatory. It's worth noting that that 2FA requirement will have (virtuous) knock-on effects: package uploads will require a
by woodruffw 3y ago
I'm very excited to see 2FA become mandatory.
It's worth noting that that 2FA requirement will have (virtuous) knock-on effects: package uploads will require an API token instead of allowing a password, meaning one less place where a user can accidentally expose control over their entire account. For packages published through GitHub Actions, PyPI's Trusted Publishing goes a step further and removes the need for a shared API token entirely[1].
[1]: https://docs.pypi.org/trusted-publishers/ https://docs.pypi.org/trusted-publishers/
- toomuchtodo 3y agoWill PyPi Passkey sign in be supported? Edit: Thank you!
- woodruffw 3y agoIt should already be (we support passkeys as an MFA method, but not as a password replacement yet).
- LtWorf 3y agoTo create a new package, you MUST generate a global token that can also do whatever on all existing packages on the account. How many people do you think will bother to delete the global token after having used it, and then generate a scoped one? 1%? Probably much less than that.
- woodruffw 3y agoYou can create a new package via a "pending publisher"[1], which does not require a user-scoped token. (Note: even though PyPI calls them "user-scoped tokens," they have less access than a password does, since they can't manage the user's account itself. So, while not ideal, they are still a better choice than a user/pass combination.) [1]: https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/ https://docs.pypi.org/trusted-publishers/creating-a-project-...
- LtWorf 3y agoOh they've listened to me at least.