A Python package repository PyPI (Python Package Index) developers have announced the implementation of mandatory two-factor authentication for all users. Without enabling two-factor authentication, users will no longer be able to upload files and perform actions related to managing their projects. Previously, two-factor authentication was enforced for user accounts that were associated with at least one project or part of an organization's package management.
The use of two-factor authentication will enhance the security of the development process and protect projects from malicious alterations due to credential leaks, the use of the same password on compromised sites, local developer system breaches, or social engineering methods. Gaining unauthorized access through account takeover is one of the most significant threats, as a successful attack can result in injecting harmful changes into other products and libraries that use the compromised package as a dependency.
The preferred method for two-factor authentication is based on hardware tokens compatible with the FIDO U2F specification and WebAuthn protocol, which allows for a higher level of security compared to generating one-time passwords. In addition to tokens, applications for authentication based on one-time passwords that support the TOTP protocol can also be used, such as Authy, Google Authenticator, and FreeOTP. When uploading packages, developers are also advised to switch to using the 'Trusted Publishers' authentication method based on the OpenID Connect (OIDC) standard or to apply API tokens.
Forrás: opennet.ru
