{"id":104623,"date":"2022-07-10T09:36:38","date_gmt":"2022-07-10T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa"},"modified":"2022-07-10T09:36:38","modified_gmt":"2022-07-10T07:36:38","slug":"vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","title":{"rendered":"Implementimi i autentifikimit me dy faktor\u00eb n\u00eb PyPI shkaktoi nj\u00eb incident t\u00eb fshirjes s\u00eb nj\u00eb pakete t\u00eb njohur","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zhvilluesit e depozit\u00ebs s\u00eb paketave Python, PyPI, publikuan nj\u00eb plan p\u00ebr kalimin n\u00eb autentifikimin me dy faktor\u00eb t\u00eb detyruesh\u00ebm p\u00ebr paketat q\u00eb p\u00ebrfshihen n\u00eb kategorin\u00eb e r\u00ebnd\u00ebsishme. R\u00ebnd\u00ebsia p\u00ebrcaktohet nga numri i shkarkimeve dhe ndryshimi do t'i n\u00ebnshtrohet llogarive t\u00eb mb\u00ebshtet\u00ebsve dhe pronar\u00ebve t\u00eb projekteve q\u00eb lidhen me 1% t\u00eb paketimeve kryesore sipas numrit t\u00eb shkarkimeve p\u00ebr 6 muajt e fundit. Duke pasur parasysh se aktualisht depozita PyPI p\u00ebrfshin m\u00eb shum\u00eb se 350,000 paketa, autentifikimi me dy faktor\u00eb do t\u00eb zbatohet p\u00ebr rreth 3,500 paketa. P\u00ebr t\u00eb verifikuar n\u00ebse llogaria \u00ebsht\u00eb n\u00eb list\u00eb, \u00ebsht\u00eb p\u00ebrgatitur nj\u00eb faqe speciale. Data e sakt\u00eb e fillimit t\u00eb autentifikimit me dy faktor\u00eb t\u00eb detyruesh\u00ebm ende nuk \u00ebsht\u00eb e p\u00ebrcaktuar, por pritet q\u00eb kjo t\u00eb ndodh\u00eb n\u00eb muajt e ardhsh\u00ebm. <\/p>\n

Ndryshe nga kalimi n\u00eb autentifikimin me dy faktor\u00eb t\u00eb projekteve RubyGems, NPM dhe GitHub, n\u00eb PyPI do t\u00eb implementohet fillimisht nj\u00eb skem\u00eb q\u00eb parashikon p\u00ebrdorimin e d\u00ebshiruesh\u00ebm t\u00eb nj\u00eb token-i harduerik me \u00e7el\u00ebsa akses. Si arsyet e rekomanduar p\u00ebr p\u00ebrdorimin e tokeneve dhe protokollit WebAuthn p\u00ebrmendet siguria m\u00eb e lart\u00eb krahasuar me gjenerimin e fjal\u00ebkalimeve t\u00eb p\u00ebrkohshme (mund\u00ebsia e p\u00ebrdorimit t\u00eb TOTP n\u00eb vend t\u00eb tokeneve do t\u00eb jet\u00eb e disponueshme n\u00eb form\u00eb opsioni). <\/p>\n

\u0422\u043e\u043a\u0435\u043d\u044b \u043c\u043e\u0436\u043d\u043e \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e — \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0430 \u0441\u043f\u043e\u043d\u0441\u043e\u0440\u043e\u043c \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b \u0438 \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0430 \u0434\u043b\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 4000 \u043a\u043b\u044e\u0447\u0435\u0439 Titan. \u041a\u0430\u0436\u0434\u044b\u0439 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0434\u0430\u0442\u044c \u0437\u0430\u044f\u0432\u043a\u0443 \u043d\u0430 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0434\u0432\u0443\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0441 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c USB-C \u0438\u043b\u0438 USB-A. \u0412\u0442\u043e\u0440\u043e\u0439 \u0442\u043e\u043a\u0435\u043d \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043d\u0430 \u0441\u043b\u0443\u0447\u0430\u0439 \u043f\u043e\u043b\u043e\u043c\u043a\u0438 \u0438\u043b\u0438 \u043f\u043e\u0442\u0435\u0440\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0438\u0441\u043a \u043f\u043e\u0442\u0435\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044e \u0438 \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0447\u0435\u0440\u0435\u0437 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0443 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. <\/p>\n

Fatkeq\u00eb, tokenet mund t\u00eb d\u00ebrgohen vet\u00ebm n\u00eb Austri, Belgjik\u00eb, Kanada, Franc\u00eb, Gjermani, Itali, Japoni, Spanj\u00eb, Zvic\u00ebr, Mbret\u00ebrin\u00eb e Bashkuar dhe SHBA. Ata q\u00eb ndodhen n\u00eb vende t\u00eb tjera mund t\u00eb blejn\u00eb vet\u00eb token\u00eb t\u00eb p\u00ebrshtatsh\u00ebm me specifikimin FIDO U2F, si\u00e7 jan\u00eb token\u00ebt Yubikey dhe Thetis. Si alternativ\u00eb, gjithashtu \u00ebsht\u00eb e mundur t\u00eb p\u00ebrdoren aplikacione p\u00ebr autentifikimin me fjal\u00ebkalime t\u00eb nj\u00ebher\u00ebshme, q\u00eb mb\u00ebshtesin protokollin TOTP, si\u00e7 jan\u00eb Authy, Google Authenticator dhe FreeOTP. <\/p>\n

Iniciativa nuk kaloi pa incidente. Autori i paket\u00ebs Atomicwrites, q\u00eb ka 6 milion shkarkime n\u00eb muaj dhe 38 milion n\u00eb 6 muaj, nuk d\u00ebshiroi t\u00eb kalonte n\u00eb autentifikim me dy faktor\u00eb dhe p\u00ebr t\u00eb p\u00ebrjashtuar paket\u00ebn e tij nga lista e atyre kritikisht t\u00eb r\u00ebnd\u00ebsishme, p\u00ebrpiqej t\u00eb rimerrte numrin e shkarkimeve. P\u00ebr ta b\u00ebr\u00eb k\u00ebt\u00eb, ai fillimisht fshiu paket\u00ebn dhe pastaj ngarkoi nj\u00eb version t\u00eb ri. Pritej q\u00eb nj\u00eb manipulim i till\u00eb thjesht do t\u00eb resetonte numrin, por p\u00ebr habin\u00eb e zhvilluesit, t\u00eb gjitha versionet e vjetra u fshin\u00eb nga repository, gj\u00eb q\u00eb shkaktoi probleme p\u00ebr projektet q\u00eb varen nga biblioteka, t\u00eb cilat disa zhvillues i krahasuan me incidentin e fshirjes s\u00eb paket\u00ebs left-pad n\u00eb NPM. <\/p>\n

Problemi u p\u00ebrkeq\u00ebsua nga fakti se pas fshirjes, autori i atomicwrites nuk arriti t\u00eb ngarkonte versionet e vjetra, t\u00eb cilat u rikthyen vet\u00ebm nj\u00eb dit\u00eb pas nd\u00ebrhyrjes s\u00eb administrator\u00ebve t\u00eb PyPI. Pas k\u00ebsaj ndodhe, autori i paket\u00ebs vendosi t\u00eb ndalonte zhvillimin e atomicwrites dhe ta kalonte paket\u00ebn n\u00eb kategorin\u00eb e t\u00eb moshuarve. Si shkak u p\u00ebrmend se ai e zhvillon projektin si nj\u00eb hobi n\u00eb koh\u00ebn e tij t\u00eb lir\u00eb dhe se k\u00ebrkesat shtes\u00eb q\u00eb komplikonin pun\u00ebn nuk ia vlenin koh\u00ebn t\u00eb cil\u00ebn e kalonte p\u00ebr mb\u00ebshtetje falas t\u00eb nj\u00eb pakete me nj\u00eb popullaritet t\u00eb till\u00eb. Autori i atomicwrites pretendohet se preferon t\u00eb shkruaj kod p\u00ebr arg\u00ebtim, nd\u00ebrsa shqet\u00ebsimet p\u00ebr sigurin\u00eb shtes\u00eb ndaj grabitjes nga hajdut\u00ebt mund t\u00eb merren p\u00ebrsip\u00ebr kur p\u00ebr k\u00ebt\u00eb paguhet. <\/p>\n

Biblioteka atomicwrites p\u00ebrmban rreth 200 rreshta kod dhe ofron funksione p\u00ebr shkarkimin e atomizuar t\u00eb skedar\u00ebve. Si z\u00ebvend\u00ebsim, mund t\u00eb p\u00ebrdoren thirrje standarde os.replace dhe os.rename (operacioni p\u00ebrfshin shkrimin n\u00eb nj\u00eb skedar me em\u00ebr p\u00ebrkoh\u00ebsor dhe riem\u00ebrimin n\u00eb skedarin e synuar pasi t\u00eb jet\u00eb gati).
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043b\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445. \u0412\u0430\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u043e \u043a \u0443\u0447\u0451\u0442\u043d\u044b\u043c \u0437\u0430\u043f\u0438\u0441\u044f\u043c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 1% \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043b\u0438\u0434\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0437\u0430 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432. \u0421 \u0443\u0447\u0451\u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 PyPI \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104623","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zbatimi i autentifikimit me dy faktor\u00eb n\u00eb PyPI shkaktoi nj\u00eb incident t\u00eb fshirjes s\u00eb nj\u00eb pakete t\u00eb njohur | ProHoster","description":"Zhvilluesit e depozitatit t\u00eb paketave Python, PyPI, publikuan nj\u00eb plan p\u00ebr kalimin n\u00eb autentifikimin me dy faktor\u00eb t\u00eb detyruesh\u00ebm p\u00ebr paketat q\u00eb bien n\u00ebn kategorin\u00eb e kritikeve.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 PyPI \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0443 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043b\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-07-10T07:36:38+00:00","article:modified_time":"2022-07-10T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104623","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-07-10 07:37:55","updated":"2022-10-08 17:25:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/104623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=104623"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/104623\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=104623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=104623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=104623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}