{"id":104623,"date":"2022-07-10T09:36:38","date_gmt":"2022-07-10T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa"},"modified":"2022-07-10T09:36:38","modified_gmt":"2022-07-10T07:36:38","slug":"vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","title":{"rendered":"Zaveden\u00ed dvoufaktorov\u00e9 autentizace v PyPI vedlo k incidentu s odstran\u011bn\u00edm popul\u00e1rn\u00edho bal\u00ed\u010dku","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1\u0159i repozit\u00e1\u0159e Python bal\u00ed\u010dk\u016f PyPI zve\u0159ejnili pl\u00e1n p\u0159echodu na povinnou dvoufaktorovou autentizaci pro bal\u00ed\u010dky, kter\u00e9 spadaj\u00ed do kategorie kriticky d\u016fle\u017eit\u00fdch. D\u016fle\u017eitost je ur\u010dena podle po\u010dtu sta\u017een\u00ed a zm\u011bna se bude vztahovat na \u00fa\u010dty spr\u00e1vc\u016f a vlastn\u00edk\u016f projekt\u016f souvisej\u00edc\u00edch s 1% bal\u00ed\u010dk\u016f, kter\u00e9 vedou v po\u010dtu sta\u017een\u00ed za posledn\u00edch 6 m\u011bs\u00edc\u016f. S ohledem na to, \u017ee repozit\u00e1\u0159 PyPI v sou\u010dasnosti zahrnuje v\u00edce ne\u017e 350 tis\u00edc bal\u00ed\u010dk\u016f, dvoufaktorov\u00e1 autentizace se bude aplikovat p\u0159ibli\u017en\u011b na 3500 bal\u00ed\u010dk\u016f. Pro ov\u011b\u0159en\u00ed, zda va\u0161e \u00fa\u010det spad\u00e1 do t\u00e9to skupiny, byla p\u0159ipravena speci\u00e1ln\u00ed str\u00e1nka. P\u0159esn\u00fd term\u00edn zaveden\u00ed povinn\u00e9 dvoufaktorov\u00e9 autentizace zat\u00edm nebyl ur\u010den, o\u010dek\u00e1v\u00e1 se, \u017ee k tomu dojde v n\u00e1sleduj\u00edc\u00edch m\u011bs\u00edc\u00edch. <\/p>\n

Na rozd\u00edl od p\u0159echodu na dvoufaktorovou autentizaci projekt\u016f RubyGems, NPM a GitHub, bude v PyPI nejprve implementov\u00e1n syst\u00e9m, kter\u00fd p\u0159edpokl\u00e1d\u00e1 doporu\u010den\u00e9 pou\u017eit\u00ed hardwarov\u00e9ho tokenu s p\u0159\u00edstupov\u00fdmi kl\u00ed\u010di. Jako d\u016fvod doporu\u010den\u00e9ho pou\u017e\u00edv\u00e1n\u00ed token\u016f a protokolu WebAuthn se uv\u00e1d\u00ed vy\u0161\u0161\u00ed bezpe\u010dnost ve srovn\u00e1n\u00ed s generov\u00e1n\u00edm jednor\u00e1zov\u00fdch hesel (mo\u017enost pou\u017eit\u00ed TOTP m\u00edsto token\u016f bude dostupn\u00e1 formou volby). <\/p>\n

Tokeny budou k dispozici zdarma \u2014 spole\u010dnost Google se stala sponzorem iniciativy a vy\u010dlenila pro projekt 4000 kl\u00ed\u010d\u016f Titan. Ka\u017ed\u00fd \u00fa\u010dastn\u00edk m\u016f\u017ee po\u017e\u00e1dat o bezplatn\u00e9 z\u00edsk\u00e1n\u00ed dvou token\u016f s portem USB-C nebo USB-A. Druh\u00fd token je zasl\u00e1n jako z\u00e1lo\u017en\u00ed pro p\u0159\u00edpad poruchy nebo ztr\u00e1ty hlavn\u00edho, aby se minimalizovalo riziko ztr\u00e1ty p\u0159\u00edstupu k repozit\u00e1\u0159i a zbavilo v\u00fdvoj\u00e1\u0159e slo\u017eit\u00e9ho procesu obnovy p\u0159\u00edstupu. <\/p>\n

Bohu\u017eel, tokeny mohou b\u00fdt zasl\u00e1ny pouze do Rakouska, Belgie, Kanady, Francie, N\u011bmecka, It\u00e1lie, Japonska, \u0160pan\u011blska, \u0160v\u00fdcarska, Velk\u00e9 Brit\u00e1nie a USA. Spr\u00e1vci z ostatn\u00edch zem\u00ed si mohou sami zakoupit kompatibiln\u00ed tokeny se specifikac\u00ed FIDO U2F, nap\u0159\u00edklad tokeny Yubikey a Thetis. Alternativn\u011b je tak\u00e9 k dispozici mo\u017enost pou\u017eit\u00ed m\u00edsto tokenu aplikac\u00ed pro autentizaci zalo\u017een\u00fdch na jednor\u00e1zov\u00fdch heslech, kter\u00e9 podporuj\u00ed protokol TOTP, nap\u0159\u00edklad Authy, Google Authenticator a FreeOTP. <\/p>\n

Iniciativa se neobe\u0161la bez incidentu. Autor bal\u00ed\u010dku Atomicwrites, kter\u00fd m\u00e1 6 milion\u016f sta\u017een\u00ed m\u011bs\u00ed\u010dn\u011b a 38 milion\u016f za 6 m\u011bs\u00edc\u016f, necht\u011bl p\u0159ej\u00edt na dvoufaktorovou autentizaci a pokusil se resetovat po\u010ditadlo sta\u017een\u00ed, aby sv\u016fj bal\u00ed\u010dek vyjmul ze seznamu kriticky d\u016fle\u017eit\u00fdch. Nejprve bal\u00ed\u010dek odstranil a pot\u00e9 nahr\u00e1l novou verzi. O\u010dek\u00e1valo se, \u017ee takov\u00e1 manipulace pouze resetuje po\u010ditadlo, ale k p\u0159ekvapen\u00ed v\u00fdvoj\u00e1\u0159e byly z repozit\u00e1\u0159e odstran\u011bny i v\u0161echny star\u00e9 verze, co\u017e vedlo k probl\u00e9m\u016fm u projekt\u016f z\u00e1visl\u00fdch na knihovn\u011b, kter\u00e9 n\u011bkte\u0159\u00ed v\u00fdvoj\u00e1\u0159i p\u0159irovnali k incidentu spojen\u00e9mu s odstran\u011bn\u00edm bal\u00ed\u010dku left-pad v NPM. <\/p>\n

Probl\u00e9m se zhor\u0161il t\u00edm, \u017ee po odstran\u011bn\u00ed autor atomicwrites nemohl nahr\u00e1t star\u00e9 verze, kter\u00e9 se poda\u0159ilo obnovit a\u017e n\u00e1sleduj\u00edc\u00ed den po z\u00e1sahu administr\u00e1tor\u016f PyPI. Po tomto incidentu se autor bal\u00ed\u010dku rozhodl p\u0159eru\u0161it v\u00fdvoj atomicwrites a za\u0159adit bal\u00ed\u010dek do kategorie zastaral\u00fdch. Jako d\u016fvod uv\u00e1d\u00ed, \u017ee projekt rozv\u00edj\u00ed jako hobby ve voln\u00e9m \u010dase a vznikaj\u00edc\u00ed dal\u0161\u00ed po\u017eadavky, zt\u011b\u017euj\u00edc\u00ed pr\u00e1ci, nestoj\u00ed za \u010das, kter\u00fd v\u011bnuje bezplatn\u00e9 podpo\u0159e bal\u00ed\u010dku s takovou popularitou. Autor atomicwrites tvrd\u00ed, \u017ee by rad\u011bji psal k\u00f3d pro z\u00e1bavu a p\u00e9\u010di o dodate\u010dnou ochranu p\u0159ed \u00fatoky zr\u00e1dc\u016f m\u016f\u017ee p\u0159evz\u00edt n\u011bkdo, kdo za to zaplat\u00ed. <\/p>\n

Knihovna atomicwrites obsahuje p\u0159ibli\u017en\u011b 200 \u0159\u00e1dk\u016f k\u00f3du a nab\u00edz\u00ed funkce pro atom\u00e1rn\u00ed zapisov\u00e1n\u00ed soubor\u016f. Jako n\u00e1hradu lze pou\u017e\u00edt standardn\u00ed vol\u00e1n\u00ed os.replace a os.rename (operace spo\u010d\u00edv\u00e1 v z\u00e1pisu do souboru s do\u010dasn\u00fdm n\u00e1zvem a p\u0159ejmenov\u00e1n\u00ed na c\u00edlov\u00fd soubor po dokon\u010den\u00ed).
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043b\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445. \u0412\u0430\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u043e \u043a \u0443\u0447\u0451\u0442\u043d\u044b\u043c \u0437\u0430\u043f\u0438\u0441\u044f\u043c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 1% \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043b\u0438\u0434\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0437\u0430 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432. \u0421 \u0443\u0447\u0451\u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 PyPI \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104623","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zaveden\u00ed dvoufaktorov\u00e9 autentizace v PyPI vedlo k incidentu s odstran\u011bn\u00edm popul\u00e1rn\u00edho bal\u00ed\u010dku | ProHoster","description":"V\u00fdvoj\u00e1\u0159i repozit\u00e1\u0159e Python bal\u00ed\u010dk\u016f PyPI zve\u0159ejnili pl\u00e1n p\u0159echodu na povinnou dvoufaktorovou autentizaci pro bal\u00ed\u010dky, kter\u00e9 spadaj\u00ed do kategorie kriticky d\u016fle\u017eit\u00fdch.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 PyPI \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0443 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043b\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-07-10T07:36:38+00:00","article:modified_time":"2022-07-10T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104623","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-07-10 07:37:55","updated":"2022-10-08 17:25:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/104623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=104623"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/104623\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=104623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=104623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=104623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}