Vzh\u013eadom na \u010dastej\u0161ie pr\u00edpady prevzatia repozit\u00e1rov ve\u013ek\u00fdch projektov a propag\u00e1cie \u0161kodliv\u00e9ho k\u00f3du cez kompromit\u00e1ciu \u00fa\u010dtov v\u00fdvoj\u00e1rov, spolo\u010dnos\u0165 GitHub zav\u00e1dza roz\u0161\u00edren\u00e9 overovanie \u00fa\u010dtov. Na za\u010diatku bud\u00faceho roka bude pre spr\u00e1vcov a administr\u00e1torov 500 najpopul\u00e1rnej\u0161\u00edch NPM bal\u00edkov zaveden\u00e1 povinn\u00e1 dvojfaktorov\u00e1 autentifik\u00e1cia. <\/p>\n
Od 7. decembra 2021 do 4. janu\u00e1ra 2022 prebehn\u00fa prevody v\u0161etk\u00fdch \u00fadr\u017eb\u00e1rov, ktor\u00ed maj\u00fa pr\u00e1vo publikova\u0165 NPM bal\u00edky, ale nepou\u017e\u00edvaj\u00fa dvojfaktorov\u00fa autentifik\u00e1ciu, na roz\u0161\u00edren\u00e9 overovanie \u00fa\u010dtov. Roz\u0161\u00edren\u00e9 overovanie predpoklad\u00e1 potrebu zad\u00e1va\u0165 jednorazov\u00fd k\u00f3d zaslan\u00fd na email pri pokuse o prihl\u00e1senie na str\u00e1nke npmjs.com alebo vykon\u00e1van\u00ed autentifikovanej oper\u00e1cie v n\u00e1stroji npm. <\/p>\n
Roz\u0161\u00edren\u00e9 overovanie nenahr\u00e1dza, ale iba dop\u013a\u0148a predt\u00fdm dostupn\u00fa volite\u013en\u00fa dvojfaktorov\u00fa autentifik\u00e1ciu, pri ktorej je potrebn\u00e9 potvrdenie pomocou jednorazov\u00fdch hesiel (TOTP). Pri aktiv\u00e1cii dvojfaktorovej autentifik\u00e1cie sa roz\u0161\u00edren\u00e9 overovanie prostredn\u00edctvom emailu nepou\u017e\u00edva. Od 1. febru\u00e1ra 2022 za\u010dne proces prevodu na povinn\u00fa dvojfaktorov\u00fa autentifik\u00e1ciu pre \u00fadr\u017eb\u00e1rov 100 najpopul\u00e1rnej\u0161\u00edch NPM bal\u00edkov s najvy\u0161\u0161\u00edm po\u010dtom z\u00e1vislost\u00ed. Po dokon\u010den\u00ed migr\u00e1cie prvej stovky sa zmena roz\u0161\u00edri na 500 najpopul\u00e1rnej\u0161\u00edch NPM bal\u00edkov pod\u013ea po\u010dtu z\u00e1vislost\u00ed. <\/p>\n
Okrem aktu\u00e1lne dostupnej sch\u00e9my dvojfaktorovej autentifik\u00e1cie zalo\u017eenej na aplik\u00e1ci\u00e1ch na generovanie jednorazov\u00fdch hesiel (Authy, Google Authenticator, FreeOTP a pod.) sa v apr\u00edli 2022 pl\u00e1nuje prida\u0165 mo\u017enos\u0165 pou\u017e\u00edvania hardv\u00e9rov\u00fdch k\u013e\u00fa\u010dov a biometrick\u00fdch skenerov, pre ktor\u00e9 existuje podpora protokolu WebAuthn, ako aj mo\u017enos\u0165 registr\u00e1cie a spr\u00e1vy r\u00f4znych dodato\u010dn\u00fdch autentifika\u010dn\u00fdch faktorov. <\/p>\n
Pripom\u00edname, \u017ee pod\u013ea v\u00fdskumu z roku 2020 len 9,27% spr\u00e1vcov bal\u00edkov pou\u017e\u00edva na ochranu pr\u00edstupu dvojfaktorov\u00fa autentifik\u00e1ciu a v 13,37% pr\u00edpadov sa pri registr\u00e1cii nov\u00fdch \u00fa\u010dtov v\u00fdvoj\u00e1ri pok\u00fasili znovu pou\u017ei\u0165 skompromitovan\u00e9 hesl\u00e1, ktor\u00e9 sa objavili v zn\u00e1mych \u00fanikoch. Po kontrole spo\u013eahlivosti pou\u017e\u00edvan\u00fdch hesiel sa podarilo z\u00edska\u0165 pr\u00edstup k 12% \u00fa\u010dtov v NPM (13% bal\u00edkov) kv\u00f4li pou\u017e\u00edvaniu predv\u00eddate\u013en\u00fdch a trivi\u00e1lnych hesiel, ako je \u201e123456\u201c. Medzi probl\u00e9mov\u00fdmi sa nach\u00e1dzali 4 \u00fa\u010dty pou\u017e\u00edvate\u013eov z Top 20 najpopul\u00e1rnej\u0161\u00edch bal\u00edkov, 13 \u00fa\u010dtov bal\u00edkov, ktor\u00e9 sa s\u0165ahovali viac ako 50 mili\u00f3nov kr\u00e1t za mesiac, 40 - viac ako 10 mili\u00f3nov s\u0165ahovan\u00ed za mesiac a 282 s viac ako 1 mili\u00f3nom s\u0165ahovan\u00ed za mesiac. Vzh\u013eadom na s\u0165ahovanie modulov na z\u00e1klade z\u00e1vislost\u00ed mohla komprimit\u00e1cia nespo\u013eahliv\u00fdch \u00fa\u010dtov zasiahnu\u0165 v s\u00fahrne a\u017e 52% zo v\u0161etk\u00fdch modulov v NPM. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 500 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f. \u0421 7 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u043f\u043e 4 \u044f\u043d\u0432\u0430\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102521","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub zav\u00e1dza v NPM povinn\u00fa roz\u0161\u00edren\u00fa verifik\u00e1ciu \u00fa\u010dtov | ProHoster","description":"V s\u00favislosti so zv\u00fd\u0161en\u00fdm po\u010dtom pr\u00edpadov prevzatia repozit\u00e1rov ve\u013ek\u00fdch projektov a \u0161\u00edrenia \u0161kodliv\u00e9ho k\u00f3du prostredn\u00edctvom kompromit\u00e1cie \u00fa\u010dtov v\u00fdvoj\u00e1rov spolo\u010dnos\u0165 GitHub zav\u00e1dza celoplo\u0161n\u00fa roz\u0161\u00edren\u00fa verifik\u00e1ciu.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432 NPM \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 | ProHoster","og:description":"\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-08T13:36:53+00:00","article:modified_time":"2021-12-08T13:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102521","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-08 13:38:11","updated":"2022-09-27 14:40:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/102521","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=102521"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/102521\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=102521"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=102521"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=102521"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"