At least on PyPI, I believe that the hashes are more intended to check download integrity than security. The new PyPI that's in the works does appear to show SHA256 hashes (see https://pypi.org/project/ipython/#files ). But the strongest hash function in the world won't protect us if someone steals our PyPI login credentials and uses them to upload valid releases.
On 10 August 2016 at 23:01, Big Stone <[email protected]> wrote: > pypi , R , anaconda are showing mainly md5 on their website (and > plumbing?) : shouldn't they use and popularize stronger hash technics ? > > On Wednesday, August 10, 2016 at 11:09:14 PM UTC+2, takowl wrote: >> >> Someone tried to get access to Kenneth Reitz's Github account, possibly >> with the intent of tampering with requests. As maintainers of another >> prominent Python project, we should be vigilant with our own accounts. >> >> We already asked everyone with commit rights to enable two-factor >> authentication. This demonstrates that was a good idea. But we should be >> aware of other attack vectors, like DNS providers and PyPI (you typically >> store PyPI passwords in plain text in a hidden .pypirc file). >> > -- > You received this message because you are subscribed to the Google Groups > "Project Jupyter" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To post to this group, send email to [email protected]. > To view this discussion on the web visit https://groups.google.com/d/ > msgid/jupyter/acdc4d6d-373a-410d-b9e8-7f01e29b287b%40googlegroups.com > <https://groups.google.com/d/msgid/jupyter/acdc4d6d-373a-410d-b9e8-7f01e29b287b%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Project Jupyter" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/CAOvn4qg6icTxNzJBjAm7BCLiGLnFHZKjvwaHMoq5ujj7rZ1FJQ%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
