On Thu, Aug 11, 2016 at 2:21 AM, Thomas Kluyver <[email protected]> wrote:
> - Someone may try to gain access to our emails to reset passwords on other > sites. This is what happened to Kenneth. Since most sites offer a password > reset by email, their security can only be as strong as the security around > our emails. > Correct, though fortunately 2FA did help in this case: the attacker did reset his password successfully, but they couldn't log in b/c he had 2FA on. > - Someone may try to steal SSH keys, which let you push to Github > bypassing 2FA. We should remove SSH keys we're no longer using from our > Github accounts, and if there's any reason to think private keys may have > been compromised, we should regenerate them. > Yes, this does allow for code compromises. 2FA does protect against certain administrative actions that can only be accomplished via the UI. But what you say about keys is certainly good practice we should follow. I have a github-specific SSH key I don't reuse for other things. > - Someone may try to steal PyPI credentials and upload malicious packages. > PyPI does not offer 2FA (yet). If you upload packages from a machine which > other people can access, check that your ~/.pypirc file is not > world-readable. Try to log in to PyPI periodically so that you will notice > if your password has been changed. > Yup, in this sense PyPI is one of the weakest links in the chain (no 2FA, passwords stored locally in plaintext, etc). Good reminder. Cheers f -- Fernando Perez (@fperez_org; http://fperez.org) fperez.net-at-gmail: mailing lists only (I ignore this when swamped!) fernando.perez-at-berkeley: contact me here for any direct mail -- You received this message because you are subscribed to the Google Groups "Project Jupyter" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/CAHAreOo0nBBx9hYMfY76tctzgunB3xttYeiuZVJN6othY7X1zA%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
