The developers of the Python package repository PyPI (Python Package Index) have implemented an additional verification step during login, requiring email confirmation of the operation if connecting from a device or browser that has not been used before. Confirmation is required in addition to the existing two-factor authentication, which requires entering a one-time code (TOTP â Time-based One-Time Password) along with the usual credentials. When using WebAuthn or Passkeys-based keys as the second factor of authentication, additional email confirmation is not required.
The reason for adding this new verification is to enhance protection against phishing. Recently, attackers have bypassed the security provided by two-factor authentication using transparent traffic proxying from phishing sites to the real site pypi.org, creating the illusion for the user of working with the genuine PyPI catalog. The login page is also proxied, and attackers control not only the initially entered login password but also the response to the second factor authentication verification request.
The additional request for credentials confirmation, with a warning about the attempt to log in from a new device, will prevent compromise in case of interception of the TOTP code and the password, and will alert developers who have not changed their hardware. During proxying, attackers can intercept account parameters and the entered one-time TOTP code, but cannot affect the email confirmation, which requires clicking on the link provided in the email.
If the user receives a verification email but has not attempted to log into the PyPI catalog, they should not click the link. If a login attempt was made but the device has not changed, one should check if the login attempt was through a phishing site and, if an attack is detected, urgently change the password and check the account activity.
Source: opennet.ru
