Vzhledem k \u010dast\u011bj\u0161\u00edm p\u0159\u00edpad\u016fm z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu k repozit\u00e1\u0159\u016fm velk\u00fdch projekt\u016f a \u0161\u00ed\u0159en\u00ed \u0161kodliv\u00e9ho k\u00f3du prost\u0159ednictv\u00edm kompromitace \u00fa\u010dt\u016f v\u00fdvoj\u00e1\u0159\u016f zav\u00e1d\u00ed spole\u010dnost GitHub plo\u0161nou roz\u0161\u00ed\u0159enou verifikaci \u00fa\u010dt\u016f. Pro spr\u00e1vce a administr\u00e1tory 500 nejpopul\u00e1rn\u011bj\u0161\u00edch NPM bal\u00ed\u010dk\u016f bude na za\u010d\u00e1tku p\u0159\u00ed\u0161t\u00edho roku zavedena povinn\u00e1 dvoufaktorov\u00e1 autentizace. <\/p>\n
Od 7. prosince 2021 do 4. ledna 2022 dojde k p\u0159evodu v\u0161ech maintainer\u016f, kte\u0159\u00ed maj\u00ed pr\u00e1vo publikovat NPM bal\u00ed\u010dky, ale nevyu\u017e\u00edvaj\u00ed dvoufaktorovou autentizaci, na pou\u017e\u00edv\u00e1n\u00ed roz\u0161\u00ed\u0159en\u00e9 verifikace \u00fa\u010dt\u016f. Roz\u0161\u00ed\u0159en\u00e1 verifikace zahrnuje nutnost zad\u00e1n\u00ed jednor\u00e1zov\u00e9ho k\u00f3du, kter\u00fd je odes\u00edl\u00e1n na email p\u0159i pokusu o p\u0159ihl\u00e1\u0161en\u00ed na web npmjs.com nebo p\u0159i prov\u00e1d\u011bn\u00ed autentizovan\u00e9 operace v n\u00e1stroji npm. <\/p>\n
Roz\u0161\u00ed\u0159en\u00e1 verifikace nenahrazuje, ale pouze dopl\u0148uje d\u0159\u00edve dostupnou volitelnou dvoufaktorovou autentizaci, p\u0159i kter\u00e9 je pot\u0159eba potvrzen\u00ed pomoc\u00ed jednor\u00e1zov\u00fdch hesel (TOTP). P\u0159i aktivaci dvoufaktorov\u00e9 autentizace nen\u00ed roz\u0161\u00ed\u0159en\u00e1 verifikace p\u0159es email pou\u017e\u00edv\u00e1na. Od 1. \u00fanora 2022 za\u010dne proces p\u0159evodu na povinnou dvoufaktorovou autentizaci pro spr\u00e1vce 100 nejpopul\u00e1rn\u011bj\u0161\u00edch NPM bal\u00ed\u010dk\u016f podle po\u010dtu z\u00e1vislost\u00ed. Po dokon\u010den\u00ed migrace prvn\u00ed stovky se zm\u011bna roz\u0161\u00ed\u0159\u00ed na 500 nejpopul\u00e1rn\u011bj\u0161\u00edch NPM bal\u00ed\u010dk\u016f podle po\u010dtu z\u00e1vislost\u00ed. <\/p>\n
Krom\u011b dostupn\u00e9ho sch\u00e9matu dvoufaktorov\u00e9 autentizace na z\u00e1klad\u011b aplikac\u00ed pro generov\u00e1n\u00ed jednor\u00e1zov\u00fdch hesel (Authy, Google Authenticator, FreeOTP atd.) pl\u00e1nuj\u00ed v dubnu 2022 p\u0159idat mo\u017enost pou\u017eit\u00ed hardwarov\u00fdch kl\u00ed\u010d\u016f a biometrick\u00fdch skener\u016f, kter\u00e9 maj\u00ed podporu protokolu WebAuthn, a tak\u00e9 mo\u017enost registrace a spr\u00e1vy r\u016fzn\u00fdch dal\u0161\u00edch autentiza\u010dn\u00edch faktor\u016f. <\/p>\n
P\u0159ipome\u0148me, \u017ee podle v\u00fdzkumu proveden\u00e9ho v roce 2020 pouze 9,27 % spr\u00e1vc\u016f bal\u00ed\u010dk\u016f pou\u017e\u00edv\u00e1 dvoufaktorovou autentizaci k ochran\u011b p\u0159\u00edstupu, a ve 13,37 % p\u0159\u00edpad\u016f se p\u0159i registraci nov\u00fdch \u00fa\u010dt\u016f v\u00fdvoj\u00e1\u0159i pokusili znovu pou\u017e\u00edt kompromitovan\u00e1 hesla, kter\u00e1 figurovala v zn\u00e1m\u00fdch \u00fanik\u00e1ch hesel. P\u0159i kontrole robustnosti pou\u017eit\u00fdch hesel se poda\u0159ilo z\u00edskat p\u0159\u00edstup k 12 % \u00fa\u010dt\u016f v NPM (13 % bal\u00ed\u010dk\u016f) kv\u016fli pou\u017eit\u00ed p\u0159edv\u00eddateln\u00fdch a trivi\u00e1ln\u00edch hesel, jako je \u201e123456\u201c. Mezi problematick\u00e9 se dostaly 4 \u00fa\u010dty u\u017eivatel\u016f z Top20 nejpopul\u00e1rn\u011bj\u0161\u00edch bal\u00ed\u010dk\u016f, 13 \u00fa\u010dt\u016f, jejich\u017e bal\u00ed\u010dky byly stahov\u00e1ny v\u00edce ne\u017e 50 milionkr\u00e1t m\u011bs\u00ed\u010dn\u011b, 40 \u2014 v\u00edce ne\u017e 10 milion\u016f sta\u017een\u00ed m\u011bs\u00ed\u010dn\u011b a 282 s v\u00edce ne\u017e 1 milionem sta\u017een\u00ed m\u011bs\u00ed\u010dn\u011b. S ohledem na stahov\u00e1n\u00ed modul\u016f v r\u00e1mci z\u00e1vislost\u00ed mohla kompromitace nespolehliv\u00fdch \u00fa\u010dt\u016f zas\u00e1hnout celkem a\u017e 52 % v\u0161ech modul\u016f v NPM. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 500 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f. \u0421 7 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u043f\u043e 4 \u044f\u043d\u0432\u0430\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102521","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub zav\u00e1d\u00ed v NPM povinnou roz\u0161\u00ed\u0159enou verifikaci \u00fa\u010dt\u016f | ProHoster","description":"Vzhledem k \u010dast\u011bj\u0161\u00edm p\u0159\u00edpad\u016fm uchv\u00e1cen\u00ed repozit\u00e1\u0159\u016f velk\u00fdch projekt\u016f a \u0161\u00ed\u0159en\u00ed \u0161kodliv\u00e9ho k\u00f3du prost\u0159ednictv\u00edm kompromitace \u00fa\u010dt\u016f v\u00fdvoj\u00e1\u0159\u016f spole\u010dnost GitHub zav\u00e1d\u00ed v\u0161ude roz\u0161\u00ed\u0159enou verifikaci.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432 NPM \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 | ProHoster","og:description":"\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-08T13:36:53+00:00","article:modified_time":"2021-12-08T13:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102521","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-08 13:38:11","updated":"2022-09-27 14:40:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102521","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=102521"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102521\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=102521"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=102521"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=102521"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"