Hacker News Reader

Comment by Tainnor | Hacker News Reader

This is laughable.

First of all, it's the slippery slope fallacy. 2FA is not a burden and you can't get any reasonable person worked up because of it. The insinuation that this might lead to other sorts of control is pointless; this possibility has always existed.

Second of all, package indexes have a responsibility to the programming community as a whole and as such I do expect them to make some reasonable demands. This is not infringing on open-source developers' freedom, since nobody forces them to release their code on an official package index.

This post really reads like a storm in a teacup.

View on HN

Not a storm in a teacup. Being forced to accept unvetted electronic devices from a 'Foundation' instead of using TOTP rings a whole lot of alarm bells.

* How do we know that these ain't fitted with GPS trackers?

* Why are maintainers forced to give up their snail mail addresses?

* How will the keys be re-issued? Who's going to pay for this?

* Oh, and there's still the silly geo-fencing issue: 'Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, United Kingdom, and the United States'

Nobody is forcing anyone to use particular devices. Those are optional. Only 2FA itself is mandatory.

You are assuming that the contributors are required to use these specific devices. This is incorrect. PyPI is offering free U2F devices to a subset of the affected developers, but they are free to use their own U2F devices (or a TOTP client) instead.

> Oh, and there's still the silly geo-fencing issue

The list of countries makes this sound like an export control issue. It's a legal restriction, not a deliberate choice PyPI made.

Timeo Danaos et dona ferentes. All in all, bad optics and fishy offerings. TOTP is definitely OK.

It seemed clearly-written and thought-provoking to me; the author doesn't claim that 2FA is a burden, either.

Writing and distributing software should be straightforward so that everyone can participate. And consuming software should be safe so that people and infrastructure are protected. Finding a security model that achieves both should be the goal.

PyPi appear to have walked a reasonable line on this so far, and it's worth considering and discussing what the future could be like.

Another reasonable point here is that pypi is also offering package owners ~$75 (edit: didn't realise they were sold in 1-packs now) in modern usb-c fido2 keys if you have one that is now marked as critical.

This last decade has played host to some of the most fascinating series of debates, an almost visceral push and pull, concerning individualism vs collectivism, distribution of control vs centralization of power.

- COVID vaccine mandates

- Cryptocurrency

- Deplatforming

- Abortion

- Closed platforms beating open web

- Monopolies controlling tech

- One party governments gaining in power

Strict control over package indices is one manifestation of this. Controlling a blast radius (safety) vs unlimited, unfettered publication (freedom).

Power structures are everywhere.

How anyone can get this worked up because of 2FA is simply beyond me.

I guess some people just have to feel like rebels all the time.

2FA is a major pain in my ass and it is the only reason why I am forced to own and use a "modern smartphone" which is essentially a corporatist surveillance device.

If more organizations just allowed me to have custodianship over my own keys like GPG for example, I could choose my own level of security by using a GPG smartcard if I wanted to.

> 2FA is a major pain in my ass and it is the only reason why I am forced to own and use a "modern smartphone" which is essentially a corporatist surveillance device.

TOTP-compliant services happily accept codes generated from non-mobile devices. 1Password even includes it (which is a unification of factors I don't personally trust, so I don't use it, but it's there if it fits your own threat model). They can also run on Android, etc. devices that literally-not-figuratively never touch the Internet, if device separation is a concern for you.

If your hangup is Duo or Okta or similar--well, there's always the choice not to work at places that necessitate them for 2FA.

> If more organizations just allowed me to have custodianship over my own keys like GPG for example, I could choose my own level of security by using a GPG smartcard if I wanted to.

Even developers don't want to touch GPG. That's why they don't and a large part of why things like Git commit signing are (IME) so rare.

I use Okta and it supports webauthn/fido just fine, seemingly by default, including touch id (or any standard USB key). If it does not, it's because your SSO administrator is intentionally turning it off.

Okta does not have my phone number or an app installed. I do not ever want to be pushed an approval, because I don't know who or what triggered it. I only want to proactively authenticate.

Oh, hey, I totally didn't even think of that. Of course a Yubikey (or whatever) would work there, too. Looks like Duo will work with FIDO2, too.

Yeah, pretty much. I explicitly want 2FA with a real 2FA factor on all of my services and all of my machines, but my caveat is that it has to be in my custody - yubikey, totp (not ideal but I do hold an encrypted back up of my seeds that I physically refresh sometimes), fido2, smart card, etc.

Push no. Push on a personal device even more no. SMS and phone absolutely FUCK NO for any reason.

You can put TOTP 2FA keys on anything. A yubikey. An app on your computer. In your password manager. Hell, build your own device from parts: https://hackaday.com/2018/01/04/two-factor-authentication-wi... . If you're forced to use SMS-based 2FA, I can't give you anything but my condolences because SMS-2FA is stupid. But most 2FA systems work with the very flexible TOTP keys so I don't understand the complaints.

I'm less interested in 2FA than the decision that folks will lose access if they don't enable it.

2FA itself is moot.

Reply on news.ycombinator.com