The developers of the Python Package Index (PyPI) repository have announced a plan to implement mandatory two-factor authentication for packages deemed critically important. Importance is determined by the number of downloads, and this change will affect the accounts of maintainers and owners of projects associated with the top 1% of packages based on download counts over the past six months. Considering that PyPI currently includes over 350,000 packages, two-factor authentication will apply to approximately 3,500 packages. A special page has been prepared to verify if an account is on the list. The exact date for the implementation of mandatory two-factor authentication has not yet been determined, but it is expected to happen in the coming months.
Unlike the transition to two-factor authentication for projects like RubyGems, NPM, and GitHub, PyPI will initially implement a scheme that encourages the use of hardware tokens with access keys. The reason for recommending the use of tokens and the WebAuthn protocol is the higher level of security compared to generating one-time passwords (the option to use TOTP instead of tokens will be available).
Tokens will be available for free—Google has sponsored the initiative and allocated 4,000 Titan keys for the project. Each maintainer can apply for two free tokens with USB-C or USB-A interfaces. The second token is provided as a backup in case the primary token is lost or broken, minimizing the risk of losing access to the repository and relieving developers from having to go through a complicated recovery process.
Unfortunately, tokens can only be sent to Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, the United Kingdom, and the United States. Maintainers from other countries can purchase FIDO U2F compatible tokens independently, such as Yubikey and Thetis tokens. Alternatively, there is also the option to use authentication apps based on one-time passwords that support the TOTP protocol, such as Authy, Google Authenticator, and FreeOTP.
The initiative was not without incident. The author of the Atomicwrites package, which counts 6 million downloads per month and 38 million over six months, refused to switch to two-factor authentication and attempted to reset the download counter to exclude his package from the critical list. To reset it, he first deleted the package and then uploaded a new version. It was expected that such manipulation would only reset the counter, but to the developer's surprise, all old versions were deleted from the repository, leading to problems for projects dependent on the library, which some developers compared to the incident resulting from the removal of the left-pad package in NPM.
The problem was exacerbated by the fact that after deletion, the author of atomicwrites was unable to upload the old versions, which could only be restored the next day after the intervention of the PyPI administrators. After the incident, the package author decided to cease development of atomicwrites and classify the package as obsolete. The reason mentioned is that he develops the project as a hobby in his spare time, and the emergence of additional requirements that complicate work is not worth the time spent on providing free support for such a popular package. The author of atomicwrites states that he would prefer just to write code for fun, leaving concerns about additional protection against malicious attacks to those who pay for it.
The atomicwrites library contains about 200 lines of code and offers functions for atomic file writing. As an alternative, the standard calls os.replace and os.rename can be used (the operation amounts to writing to a temporary file and renaming it to the target file after it's ready).
Source: opennet.ru
