A Python Package Index (PyPI) repository developers have implemented an additional verification step during login that requires email confirmation for operations when connecting from a device or browser that has not been previously logged in. Confirmation is required in addition to the existing two-factor authentication that requires entering a one-time code (TOTP – Time-based One-Time Password) along with standard credentials. When using keys based on WebAuthn or Passkeys as a second authentication factor, additional email confirmation is not required.
The reason for adding the new verification is to strengthen protection against phishing. Recently, attackers have been circumventing the two-factor authentication protection by using transparent traffic proxying from phishing sites to the real pypi.org site, creating the illusion for the user of interacting with the actual PyPI catalog. The login page is also proxied, and attackers control not only the initially entered login password but also the response to the second-factor authentication validation request.
An additional request for authority confirmation with a warning about the attempt to log in from a new device will prevent compromise in case of interception of the TOTP code and password, and will alert developers who have not changed their equipment. During proxying, attackers can intercept the account parameters and the entered one-time TOTP code, but they cannot affect the email confirmation that requires clicking on the link provided in the email.
If a user receives a verification email but has not attempted to log into the PyPI catalog, they should not click on the link. If the login attempt was made but the device has not changed, it should be checked whether the login attempt was through a phishing site, and in case of detecting an attack, it is urgent to change the password and check account activity.
Forrás: opennet.ru
