{"id":112660,"date":"2024-01-02T09:10:17","date_gmt":"2024-01-02T07:10:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/katalog-pypi-pereshyol-na-obyazatelnuyu-dvuhfaktornuyu-autentifikacziyu"},"modified":"2024-01-02T09:10:17","modified_gmt":"2024-01-02T07:10:17","slug":"katalog-pypi-pereshyol-na-obyazatelnuyu-dvuhfaktornuyu-autentifikacziyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/katalog-pypi-pereshyol-na-obyazatelnuyu-dvuhfaktornuyu-autentifikacziyu","title":{"rendered":"The PyPI catalog has transitioned to mandatory two-factor authentication.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The developers of the Python package repository PyPI (Python Package Index) have announced the implementation of mandatory two-factor authentication for all users. Without enabling two-factor authentication, users will no longer be able to upload files or perform actions related to managing their projects. Previously, two-factor authentication was enforced for user accounts associated with at least one project or those involved in maintaining organization packages. <\/p>\n
Implementing two-factor authentication will strengthen the development process's security and protect projects from malicious changes resulting from credential leaks, using the same password on a compromised site, local developer system breaches, or social engineering tactics. Gaining access via account takeover is one of the most significant threats, as a successful attack can lead to injecting malicious changes into other products and libraries that use the compromised package as a dependency. <\/p>\n
As the preferred method of two-factor authentication, a scheme based on FIDO U2F compatible hardware tokens and the WebAuthn protocol has been declared, allowing for a higher level of security compared to one-time password generation. In addition to tokens, authentication applications based on one-time passwords that support the TOTP protocol can also be used, such as Authy, Google Authenticator, and FreeOTP. When loading packages, developers are additionally recommended to switch to using the 'Trusted Publishers' authentication method based on the OpenID Connect (OIDC) standard or to implement API tokens. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"