A GitHub bejelentette, hogy az NPM t\u00e1rol\u00f3kban k\u00f6telez\u0151v\u00e9 teszi a k\u00e9tfaktoros hiteles\u00edt\u00e9st a 100 NPM-csomag sz\u00e1m\u00e1ra, amelyek a legnagyobb sz\u00e1m\u00fa csomag f\u00fcgg\u0151s\u00e9gei. A fenti csomagok fenntart\u00f3i ezent\u00fal csak akkor hajthatnak v\u00e9gre hiteles\u00edt\u00e9st ig\u00e9nyl\u0151 m\u0171veleteket a t\u00e1rol\u00f3val, ha a k\u00e9tfaktoros hiteles\u00edt\u00e9st aktiv\u00e1lt\u00e1k, amely egy egyszeri jelsz\u00f3t k\u00e9r bejelentkez\u00e9skor, az Authy, a Google Authenticator vagy a FreeOTP alkalmaz\u00e1sok \u00e1ltal gener\u00e1lt TOTP seg\u00edts\u00e9g\u00e9vel. A k\u00f6zelj\u00f6v\u0151ben a TOTP mellett tervezik a hardveres kulcsok \u00e9s biometri\u00e1s olvas\u00f3k t\u00e1mogat\u00e1s\u00e1nak bevezet\u00e9s\u00e9t is, amelyek a WebAuth protokollt haszn\u00e1lj\u00e1k. <\/p>\n
M\u00e1rcius 1-j\u00e9n tervezz\u00fck az \u00f6sszes olyan NPM-felhaszn\u00e1l\u00f3i fi\u00f3k \u00e1tkonvert\u00e1l\u00e1s\u00e1t, amelyeken nincs bekapcsolva a k\u00e9tfaktoros hiteles\u00edt\u00e9s, egy kib\u0151v\u00edtett fi\u00f3kellen\u0151rz\u00e9sre, amely egy egyszeri k\u00f3d megad\u00e1s\u00e1t ig\u00e9nyli, amely az npmjs.com webhelyre val\u00f3 bel\u00e9p\u00e9s vagy az npm eszk\u00f6zben v\u00e9grehajtott hiteles\u00edt\u00e9st ig\u00e9nyl\u0151 m\u0171velet sor\u00e1n \u00e9rkezik e-mailben. A k\u00e9tfaktoros hiteles\u00edt\u00e9s enged\u00e9lyez\u00e9s\u00e9vel az e-mailes kib\u0151v\u00edtett ellen\u0151rz\u00e9s nem alkalmazhat\u00f3. Febru\u00e1r 16-\u00e1n \u00e9s 13-\u00e1n 24 \u00f3r\u00e1s pr\u00f3ba\u00fczem\u00e9t hajtunk v\u00e9gre a kib\u0151v\u00edtett hiteles\u00edt\u00e9snek minden felhaszn\u00e1l\u00f3i fi\u00f3kra. <\/p>\n
Eml\u00e9keztet\u0151\u00fcl, a 2020-ban v\u00e9gzett kutat\u00e1s szerint mind\u00f6ssze a csomagok karbantart\u00f3inak 9,27%-a alkalmazta a k\u00e9tt\u00e9nyez\u0151s hiteles\u00edt\u00e9st a hozz\u00e1f\u00e9r\u00e9s v\u00e9delme \u00e9rdek\u00e9ben, \u00e9s az esetek 13,37%-\u00e1ban a fejleszt\u0151k a regisztr\u00e1ci\u00f3 sor\u00e1n megpr\u00f3b\u00e1lt\u00e1k \u00fajra felhaszn\u00e1lni a m\u00e1r kor\u00e1bban kompromitt\u00e1lt jelszavakat, amelyek ismert jelsz\u00f3leakokban szerepeltek. A haszn\u00e1lt jelszavak megb\u00edzhat\u00f3s\u00e1g\u00e1nak ellen\u0151rz\u00e9se sor\u00e1n 12%-os hozz\u00e1f\u00e9r\u00e9st siker\u00fclt el\u00e9rni az NPM fi\u00f3kjaihoz (13%-os pakkra vonatkoz\u00f3an) a j\u00f3slhat\u00f3 \u00e9s trivi\u00e1lis jelszavak, mint p\u00e9ld\u00e1ul a \"123456\" haszn\u00e1lata miatt. Probl\u00e9m\u00e1snak bizonyult 4 felhaszn\u00e1l\u00f3i fi\u00f3k a 20 legn\u00e9pszer\u0171bb csomag k\u00f6z\u00fcl, 13 fi\u00f3k, amelynek csomagjait havi t\u00f6bb mint 50 milli\u00f3 alkalommal t\u00f6lt\u00f6tt\u00e9k le, 40 fi\u00f3k, amelynek csomagjait havi t\u00f6bb mint 10 milli\u00f3 alkalommal t\u00f6lten\u00e9k le, \u00e9s 282 fi\u00f3k, amelynek csomagjai havi t\u00f6bb mint 1 milli\u00f3 let\u00f6lt\u00e9st \u00e9rtek el. Figyelembe v\u00e9ve a modulok l\u00e1ncolat\u00e1nak dependency-j\u00e9t, a megb\u00edzhatatlan fi\u00f3kok kompromitt\u00e1l\u00e1sa \u00f6sszesen ak\u00e1r 52%-\u00e1t is \u00e9rintheti az \u00f6sszes modulnak az NPM-ben. GitHub \u043e\u0431\u044a\u044f\u0432\u0438\u043b \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043b\u044f 100 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043a\u0430\u043a \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0435\u0435 \u0447\u0438\u0441\u043b\u043e \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0421\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442\u043d\u044b\u043d\u0435 \u0441\u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0434\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043e\u0434\u043d\u043e\u0440\u0430\u0437\u043e\u0432\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 (TOTP), \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0442\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438, \u043a\u0430\u043a Authy, Google Authenticator \u0438 FreeOTP. \u0412 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103184","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A NPM-ben k\u00f6telez\u0151 k\u00e9tfaktoros hiteles\u00edt\u00e9s lett bevezetve a 100 legn\u00e9pszer\u0171bb csomaghoz | ProHoster","description":"A GitHub bejelentette, hogy az NPM t\u00e1rol\u00f3kban k\u00f6telez\u0151v\u00e9 teszi a k\u00e9tfaktoros hiteles\u00edt\u00e9st a 100 NPM-csomag sz\u00e1m\u00e1ra, amelyek a legnagyobb sz\u00e1m\u00fa csomag f\u00fcgg\u0151s\u00e9gei.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-npm-vklyuchena-obyazatelnaya-dvuhfaktornaya-autentifikacziya-dlya-100-samyh-populyarnyh-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 NPM \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0434\u043b\u044f 100 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"GitHub \u043e\u0431\u044a\u044f\u0432\u0438\u043b \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043b\u044f 100 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043a\u0430\u043a \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0435\u0435 \u0447\u0438\u0441\u043b\u043e \u043f\u0430\u043a\u0435\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-npm-vklyuchena-obyazatelnaya-dvuhfaktornaya-autentifikacziya-dlya-100-samyh-populyarnyh-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-03T13:36:52+00:00","article:modified_time":"2022-02-03T13:36:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103184","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-03 13:38:01","updated":"2022-10-08 08:35:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/103184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=103184"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/103184\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=103184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=103184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=103184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"