Dear PyPI users:
To increase the security of PyPI downloads, we have added
two-factor authentication (2FA) as a login security option,
and API tokens for uploading packages.
If you maintain or own a project on the Python Package Index
[pypi.org], you should start using these features. Click "help"
on PyPI for instructions.
See details, explanations, and screenshots in our blog post today:
https://pyfound.blogspot.com/2020/01/start-using-2fa-and-api-tokens-on-pypi…
A condensed explanation follows.
2FA:
Two-factor authentication makes your account more secure by
requiring two things in order to log in: something you know
and something you own.
In PyPI's case, "something you know" is your username and
password, while "something you own" can be an application
to generate a temporary code, or a security device (most
commonly a USB key). PyPI's implementation of the WebAuthn
standard means you can use any 2FA device that meets the
FIDO standard.
2FA only affects logging in via a web browser, and not
(yet) package uploads.
API tokens:
API tokens provide an alternative way (instead of username and
password) to authenticate when uploading packages to PyPI.
You can create a token for an entire PyPI account, in which
case, the token will work for all projects associated with
that account. Alternatively, you can limit a token's scope
to a specific project. That way, if a token is compromised,
you can just revoke and recreate that token, instead of
having to change your password in lots of automated processes.
For more details and instructions, click "help" on PyPI, or
go to: https://pypi.org/help/
These features are also available on Test PyPI.
Future:
In the future, PyPI will set and enforce a policy requiring
users with two-factor authentication enabled to use API tokens
to upload (rather than just their password, without a second
factor). We do not yet know when we will make this policy change;
when we decide on a timeline, we will announce the change on this list.
Thanks to the Open Technology Fund for funding this work.
More work is in progress on pip and PyPI -- see https://wiki.python.org/psf/PackagingWG .
Please forward to other PyPI users, especially package maintainers.
-Sumana Harihareswara on behalf of the PyPI team
