|
Size: 5918
Comment: formatting, post-launch wording
|
Size: 5384
Comment: WebAuthn testing
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 3: | Line 3: |
| Warehouse is the code behind the Python Package Repository ([[https://pypi.org/|PyPI]]) ([[https://github.com/pypa/warehouse|source code on GitHub]],[[https://wiki.python.org/psf/WarehouseRoadmap|roadmap]]). We are seeking maintainers of Projects on PyPI to test our new two-factor auth functionality and send us bug reports. | Warehouse is the code behind the Python Package Repository ([[https://pypi.org/|PyPI]]). We are seeking maintainers of Projects on PyPI to test our new two-factor auth functionality and send us bug reports. |
| Line 18: | Line 18: |
| Starting this Friday, May 3rd, you'll be able to use 2FA on [[http://test.pypi.org/|Test PyPI]]. And if you'd like to try 2FA on [[https://pypi.org|official PyPI]], please fill out [[https://docs.google.com/forms/d/e/1FAIpQLSfRmXhkfAL-LgLfcMdzTG7iIaSwPo-pyzkgv5DzvAU7Q-6XWQ/viewform|this Google form]] so we can invite you to the private beta, which we plan to hold 3-20 May. | You can use 2FA right now on [[http://test.pypi.org/|Test PyPI]] and on [[https://pypi.org|official PyPI]]. PyPI currently supports a single 2FA method: generating a code through a Time-based One-time Password (TOTP) application. After you set up 2FA on your PyPI account, then you must provide a TOTP (along with your username and password) to log in. Therefore, to use 2FA on PyPI, you'll need to provision an application (usually a mobile phone app) in order to generate authentication codes; see below for suggestions and pointers. |
| Line 20: | Line 20: |
| PyPI currently supports a single 2FA method: generating a code through a Time-based One-time Password (TOTP) application. After you set up 2FA on your PyPI account, then you must provide a TOTP (along with your username and password) to log in. Therefore, to use 2FA on PyPI, you'll need to provision an application (usually a mobile phone app) in order to generate authentication codes; see below for suggestions and pointers. | And starting Tuesday, June 11th, we'll also support WebAuthn and thus "security keys". A security key (also known as a universal second factor, or U2F key) is hardware device that communicates via USB, NFC, or Bluetooth. Popular keys include Yubikey, Google Titan and Thetis. PyPI supports any [[https://fidoalliance.org/specifications/download/|FIDO U2F compatible key]] and follows the [[https://www.w3.org/TR/webauthn/}WebAuthn standard]]. Users who have set up this second factor will be prompted to use their key (usually by inserting it into a USB port and pressing a button) when logging in. |
| Line 22: | Line 22: |
| This change only applies to the login step, not package uploads. | Two-factor authentication currently only applies to the login step, not package uploads. |
| Line 25: | Line 25: |
| Most of these you can test [[http://pypi.org/|on pypi.org]] once you opt into the private beta. For testing destructive actions, like removing an owner, deleting a project, or deleting a release, please use [[https://test.pypi.org/|test.pypi.org]]. | Most of these you can test [[http://pypi.org/|on pypi.org]]. For testing destructive actions, like removing an owner, deleting a project, or deleting a release, please use [[https://test.pypi.org/|test.pypi.org]]. |
| Line 29: | Line 29: |
| During this testing period, if things go awry, there's a chance we will need to wipe tokens from users' accounts, so if you choose to try it, please be forewarned. We suggest you make sure you have a PyPI-verified email address on your user account before trying the feature, to make potential account recovery smoother. | During this testing period, if things go awry, there's a chance we will need to wipe tokens from users' accounts, so if you choose to try it, please be forewarned. That's why you need a PyPI-verified email address on your user account before trying the feature, to make potential account recovery smoother. |
| Line 35: | Line 35: |
| * Add/Remove 2FA token using TOTP * Upload package |
* Add, disable, and remove 2FA token using TOTP * Add, disable, and remove 2FA token using U2F (WebAuthn) |
| Line 38: | Line 38: |
| * Set multiple tokens and login | |
| Line 49: | Line 50: |
| * use an unusual TOTP app | * use an unusual TOTP app or U2F token |
| Line 57: | Line 58: |
| Users who have chosen to set up two factor authentication (2FA) on their PyPI account must, once 2FA is set up, provide a second method of identity verification (other than their username and password) for each login. PyPI currently supports a single 2FA method: Generating a code through a TOTP application. When enabling two factor authentication (2FA) via [[https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm|TOTP]] in your account admin, you are asked to provision an application (usually a mobile phone app) in order to generate authentication codes. Popular applications include: * [[https://freeotp.github.io/|FreeOTP]] (open source) * [[https://play.google.com/store/apps/details?id=org.liberty.android.freeotpplus|FreeOTP+]] (open source) * Google Authenticator for [[https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2|Android]] or [[https://itunes.apple.com/app/google-authenticator/id388497605|iPhone]] (proprietary) * [[https://authy.com/|Authy]] (proprietary) * Duo Mobile for [[https://play.google.com/store/apps/details?id=com.duosecurity.duomobile|Android]] and [[https://itunes.apple.com/app/duo-mobile/id422663827|iPhone]] (proprietary) |
See [[https://pypi.org/help/#totp|our help docs]] for guidance on choosing a TOTP app for desktop or mobile. |
| Line 71: | Line 63: |
| == Try it at PyCon == Warehouse developers will be [[PackagingSprints|at the PyCon sprints]] May 6-9 to talk about problems you run into, or about how to hack on Warehouse. |
== Our next steps == |
| Line 74: | Line 65: |
| Feel free to drop in! | We expect to move on to working on [[https://github.com/pypa/warehouse/issues/994|scoped API keys to make package upload more secure]], then further security, accessibility, and internationalization tasks per [[https://wiki.python.org/psf/WarehouseRoadmap|the Warehouse roadmap]]). Thanks to the Open Technology Fund for funding this work. More progress reports at [[https://wiki.python.org/psf/PackagingWG|the Packaging Working Group's wiki page]]. |
| Line 83: | Line 74: |
| Email: [[https://groups.google.com/forum/#!forum/pypa-dev|pypa-dev mailing list]] | Email: [[https://mail.python.org/mailman3/lists/distutils-sig.python.org/|distutils-sig mailing list]] |
Help us test PyPI's 2-Factor Auth!
Warehouse is the code behind the Python Package Repository (PyPI). We are seeking maintainers of Projects on PyPI to test our new two-factor auth functionality and send us bug reports.
Feedback on user experience, accessibility, and overall ease of use are welcome; we want to support your workflows for account management and package maintainership. Go to the test site at https://test.pypi.org/ and try it out!
Contents
Guidelines for Particpation
By participating, you agree to abide by the PyPA Code of Conduct.
- We strongly recommend you verify your primary email address on your Test PyPI and PyPI accounts before setting up 2FA.
You should sign up for the PyPI Announcement Mailing List for updates.
Changes we're making
To increase the security of PyPI downloads, we're beginning to introduce two-factor authentication (2FA) as a login security option.
You can use 2FA right now on Test PyPI and on official PyPI. PyPI currently supports a single 2FA method: generating a code through a Time-based One-time Password (TOTP) application. After you set up 2FA on your PyPI account, then you must provide a TOTP (along with your username and password) to log in. Therefore, to use 2FA on PyPI, you'll need to provision an application (usually a mobile phone app) in order to generate authentication codes; see below for suggestions and pointers.
And starting Tuesday, June 11th, we'll also support WebAuthn and thus "security keys". A security key (also known as a universal second factor, or U2F key) is hardware device that communicates via USB, NFC, or Bluetooth. Popular keys include Yubikey, Google Titan and Thetis. PyPI supports any FIDO U2F compatible key and follows the https://www.w3.org/TR/webauthn/}WebAuthn standard. Users who have set up this second factor will be prompted to use their key (usually by inserting it into a USB port and pressing a button) when logging in.
Two-factor authentication currently only applies to the login step, not package uploads.
Things to test
Most of these you can test on pypi.org. For testing destructive actions, like removing an owner, deleting a project, or deleting a release, please use test.pypi.org.
Caution (before you test)
During this testing period, if things go awry, there's a chance we will need to wipe tokens from users' accounts, so if you choose to try it, please be forewarned. That's why you need a PyPI-verified email address on your user account before trying the feature, to make potential account recovery smoother.
Reminder! Sign up for the PyPI Announcement Mailing List to be kept in the loop as we continue this process!
Workflows
- Verify primary email address
- Add, disable, and remove 2FA token using TOTP
Add, disable, and remove 2FA token using U2F (WebAuthn)
- Login/Logout
- Set multiple tokens and login
- User Registration and Confirmation
- Password Reset
Testers we need
In particular, please help us test this if any of these apply to you:
- use Windows
- usually visit PyPI on a mobile device
- are an organization where users share an auth token within a group
- have 4+ maintainers or owners for one project
- use an unusual TOTP app or U2F token
- have a slow Internet connection
block cookies and JavaScript
- maintain 20+ projects
- created your PyPI account 6+ years ago
Setting up a TOTP application
See our help docs for guidance on choosing a TOTP app for desktop or mobile.
Security bugs
If you find any potential security vulnerabilities, please follow our published security policy. Please don't report security issues in Warehouse via GitHub, IRC, or mailing lists. Instead, please directly email one or more of our maintainers.
Our next steps
We expect to move on to working on scoped API keys to make package upload more secure, then further security, accessibility, and internationalization tasks per the Warehouse roadmap). Thanks to the Open Technology Fund for funding this work. More progress reports at the Packaging Working Group's wiki page.
Contact us
Security issues: email security @ python dot org
GitHub for all other bug reports & feature requests:https://github.com/pypa/warehouse/issues/new
IRC: #pypa-dev on Freenode (someone's usually there 10am-5pm Central Time on weekdays)
Email: distutils-sig mailing list
Thank you for testing Warehouse! You're helping us secure this ecosystem, and future users of PyPI will appreciate it. 