{"id":104623,"date":"2022-07-10T09:36:38","date_gmt":"2022-07-10T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa"},"modified":"2022-07-10T09:36:38","modified_gmt":"2022-07-10T07:36:38","slug":"vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","title":{"rendered":"Zavedenie dvojfaktorovej autentifik\u00e1cie v PyPI viedlo k incidentu s odstr\u00e1nen\u00edm popul\u00e1rneho bal\u00edka","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1ri repozit\u00e1ra Python bal\u00edkov PyPI zverejnili pl\u00e1n prechodu na povinn\u00fa dvojfaktorov\u00fa autentifik\u00e1ciu pre bal\u00edky, ktor\u00e9 spadaj\u00fa do kateg\u00f3rie kriticky d\u00f4le\u017eit\u00fdch. D\u00f4le\u017eitos\u0165 sa ur\u010duje pod\u013ea po\u010dtu stiahnut\u00ed a zmena sa bude uplat\u0148ova\u0165 na \u00fa\u010dty spr\u00e1vcov a vlastn\u00edkov projektov, ktor\u00e9 s\u00favisia s 1 % bal\u00edkov, ktor\u00e9 ved\u00fa v po\u010dte stiahnut\u00ed za posledn\u00fdch 6 mesiacov. S zoh\u013eadnen\u00edm, \u017ee v s\u00fa\u010dasnosti repozit\u00e1r PyPI obsahuje viac ako 350 tis\u00edc bal\u00edkov, dvojfaktorov\u00e1 autentifik\u00e1cia sa bude uplat\u0148ova\u0165 pribli\u017ene na 3500 bal\u00edkov. Na overenie, \u010di sa \u00fa\u010det nach\u00e1dza v zozname, bola pripraven\u00e1 \u0161peci\u00e1lna str\u00e1nka. Presn\u00fd d\u00e1tum zavedenia povinnej dvojfaktorovej autentifik\u00e1cie zatia\u013e nie je ur\u010den\u00fd, predpoklad\u00e1 sa, \u017ee k tomu d\u00f4jde v najbli\u017e\u0161\u00edch mesiacoch. <\/p>\n

Na rozdiel od prechodu na dvojfaktorov\u00fa autentifik\u00e1ciu projektov RubyGems, NPM a GitHub, v PyPI bude spo\u010diatku zaveden\u00fd syst\u00e9m, ktor\u00fd predpoklad\u00e1 preferovan\u00e9 pou\u017eitie hardv\u00e9rov\u00e9ho tokenu s pr\u00edstupov\u00fdmi k\u013e\u00fa\u010dmi. Ako d\u00f4vod odpor\u00fa\u010dan\u00e9ho pou\u017eitia tokenov a protokolu WebAuthn sa uv\u00e1dza vy\u0161\u0161ia bezpe\u010dnos\u0165 v porovnan\u00ed s generovan\u00edm jednorazov\u00fdch hesiel (mo\u017enos\u0165 pou\u017eitia TOTP namiesto tokenov bude dostupn\u00e1 formou mo\u017enosti). <\/p>\n

Tokeny bude mo\u017en\u00e9 z\u00edska\u0165 zadarmo \u2014 spolo\u010dnos\u0165 Google poskytla podporu iniciat\u00edvy a vy\u010dlenila pre projekt 4000 k\u013e\u00fa\u010dov Titan. Ka\u017ed\u00fd \u00fa\u010dastn\u00edk si m\u00f4\u017ee po\u017eiada\u0165 o bezplatn\u00e9 z\u00edskanie dvoch tokenov s rozhran\u00edm USB-C alebo USB-A. Druh\u00fd token sa posiela ako z\u00e1lo\u017en\u00fd v pr\u00edpade poruchy alebo straty hlavn\u00e9ho, aby sa minimalizovalo riziko straty pr\u00edstupu k repozit\u00e1ru a aby sa v\u00fdvoj\u00e1ri zbavili potreby prech\u00e1dza\u0165 zlo\u017eit\u00fdm procesom obnovenia pr\u00edstupu. <\/p>\n

\u017dia\u013e, tokeny je mo\u017en\u00e9 zasiela\u0165 iba do Rak\u00faska, Belgicka, Kanady, Franc\u00fazska, Nemecka, Talianska, Japonska, \u0160panielska, \u0160vaj\u010diarska, Spojen\u00e9ho kr\u00e1\u013eovstva a USA. Sprievodcovia z in\u00fdch kraj\u00edn si m\u00f4\u017eu zak\u00fapi\u0165 kompatibiln\u00e9 s FIDO U2F tokeny, ako s\u00fa napr\u00edklad tokeny Yubikey a Thetis. Alternat\u00edvne sa m\u00f4\u017ee pou\u017ei\u0165 aj aplik\u00e1cia na autentifik\u00e1ciu zalo\u017een\u00e1 na jednorazov\u00fdch hesl\u00e1ch, ktor\u00e1 podporuje protokol TOTP, ako napr\u00edklad Authy, Google Authenticator a FreeOTP. <\/p>\n

Iniciat\u00edva sa neobi\u0161la bez incidentu. Autor bal\u00edka Atomicwrites, ktor\u00fd m\u00e1 6 mili\u00f3nov stiahnut\u00ed mesa\u010dne a 38 mili\u00f3nov za 6 mesiacov, sa odmietol prepn\u00fa\u0165 na dvojfaktorov\u00fa autentifik\u00e1ciu a na vyl\u00fa\u010denie svojho bal\u00edka zo zoznamu kriticky d\u00f4le\u017eit\u00fdch sa pok\u00fasil resetova\u0165 po\u010det stiahnut\u00ed. Na resetovanie najprv odstr\u00e1nil bal\u00edk a potom na\u010d\u00edtal nov\u00fa verziu. O\u010dak\u00e1valo sa, \u017ee tak\u00e1to manipul\u00e1cia iba resetuje po\u010det, ale na prekvapenie v\u00fdvoj\u00e1ra boli z repozit\u00e1ra odstr\u00e1nen\u00e9 aj v\u0161etky star\u00e9 verzie, \u010do sp\u00f4sobilo probl\u00e9my z\u00e1visl\u00fdm projektom, ktor\u00e9 niektor\u00ed v\u00fdvoj\u00e1ri porovnali s incidentom, ktor\u00fd sp\u00f4sobil odstr\u00e1nenie bal\u00edka left-pad v NPM. <\/p>\n

Probl\u00e9m sa zhor\u0161il t\u00fdm, \u017ee po odstr\u00e1nen\u00ed autor atomicwrites nemohol na\u010d\u00edta\u0165 star\u00e9 verzie, ktor\u00e9 sa podarilo obnovi\u0165 a\u017e nasleduj\u00faci de\u0148 po z\u00e1sahu administr\u00e1torov PyPI. Po t\u00fdchto udalostiach sa autor bal\u00edka rozhodol ukon\u010di\u0165 v\u00fdvoj atomicwrites a previes\u0165 bal\u00edk do stavu zastaran\u00e9ho. Ako d\u00f4vod uv\u00e1dza, \u017ee projekt vyv\u00edja ako hobby vo svojom vo\u013enom \u010dase a dodato\u010dn\u00e9 po\u017eiadavky, ktor\u00e9 komplikuj\u00fa pr\u00e1cu, nestoj\u00ed za \u010das venovan\u00fd bezplatnej podpore bal\u00edka s takou popularitou. Autor atomicwrites tvrd\u00ed, \u017ee by rad\u0161ej jednoducho p\u00edsal k\u00f3d pre z\u00e1bavu a starosti o dodato\u010dn\u00fa ochranu pred \u00fatokmi mo\u017eno zveri\u0165 niekomu, kto za to plat\u00ed. <\/p>\n

Kni\u017enica atomicwrites obsahuje pribli\u017ene 200 riadkov k\u00f3du a pon\u00faka funkcie na atom\u00e1rne z\u00e1pisy s\u00faborov. Ako n\u00e1hradu je mo\u017en\u00e9 pou\u017ei\u0165 \u0161tandardn\u00e9 volania os.replace a os.rename (oper\u00e1cia spo\u010d\u00edva v z\u00e1pise do s\u00faboru s do\u010dasn\u00fdm n\u00e1zvom a premenovan\u00ed na cie\u013eov\u00fd s\u00fabor po dokon\u010den\u00ed).
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043b\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445. \u0412\u0430\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u043e \u043a \u0443\u0447\u0451\u0442\u043d\u044b\u043c \u0437\u0430\u043f\u0438\u0441\u044f\u043c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 1% \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043b\u0438\u0434\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0437\u0430 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432. \u0421 \u0443\u0447\u0451\u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 PyPI \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104623","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Implement\u00e1cia dvojfaktorovej autentifik\u00e1cie v PyPI viedla k incidentu s odstr\u00e1nen\u00edm popul\u00e1rneho bal\u00edka | ProHoster","description":"V\u00fdvoj\u00e1ri repozit\u00e1ra Python bal\u00edkov PyPI zverejnili pl\u00e1n prechodu na povinn\u00fa dvojfaktorov\u00fa autentifik\u00e1ciu pre bal\u00edky, ktor\u00e9 patria do kateg\u00f3rie kriticky d\u00f4le\u017eit\u00fdch.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 PyPI \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0443 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043b\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-07-10T07:36:38+00:00","article:modified_time":"2022-07-10T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104623","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-07-10 07:37:55","updated":"2022-10-08 17:25:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/104623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=104623"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/104623\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=104623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=104623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=104623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}