I find it bizarre that they don't ask for 2FA for all contributions. Possibly a historical inheritance?
Edit: I now understand that they require a physical device instead of a TOTP app. Yeah, that's the line between reasonable and wtf.
Edit: I now understand that they require a physical device instead of a TOTP app. Yeah, that's the line between reasonable and wtf.
> Without multiple 2FA options, effect of losing a 2FA method results in the need to fully recover an account, which is burdensome and time-consuming both for maintainers and PyPI administrators. Enabling multiple 2FA methods reduces the potential disruption if one is lost.
So there's a huge practical difference to PyPI of enforcing 2FA for all vs. enforcing for <1% of projects. I don't envy their position, and it's a reasonable compromise IMO.
That said, it's absurd that PyPI didn't make more clear in the announcement linked above that TOTP apps are allowed. There's literally not an FAQ about the most important FAQ. They very well could have avoided the reaction from OP, and this entire debacle, with more thoughtful messaging.
No, a TOTP app is also allowed.
https://pypi.org/security-key-giveaway
They're being beyond reasonable. This is outright kind.
They don't.