I think a few months ago Jason made an effort to audit our permissions, that was probably a good idea. In light of this, I'm willing to give up pypi authorization to many of our projects, but I should probably stay on ipywidgets,just in case... I never liked publishing to pypi anyways ;)
On Aug 11, 2016 11:56 AM, "Fernando Perez" <[email protected]> wrote: > On Thu, Aug 11, 2016 at 2:21 AM, Thomas Kluyver <[email protected]> wrote: > >> - Someone may try to gain access to our emails to reset passwords on >> other sites. This is what happened to Kenneth. Since most sites offer a >> password reset by email, their security can only be as strong as the >> security around our emails. >> > > Correct, though fortunately 2FA did help in this case: the attacker did > reset his password successfully, but they couldn't log in b/c he had 2FA on. > > >> - Someone may try to steal SSH keys, which let you push to Github >> bypassing 2FA. We should remove SSH keys we're no longer using from our >> Github accounts, and if there's any reason to think private keys may have >> been compromised, we should regenerate them. >> > > Yes, this does allow for code compromises. 2FA does protect against > certain administrative actions that can only be accomplished via the UI. > But what you say about keys is certainly good practice we should follow. I > have a github-specific SSH key I don't reuse for other things. > > >> - Someone may try to steal PyPI credentials and upload malicious >> packages. PyPI does not offer 2FA (yet). If you upload packages from a >> machine which other people can access, check that your ~/.pypirc file is >> not world-readable. Try to log in to PyPI periodically so that you will >> notice if your password has been changed. >> > > Yup, in this sense PyPI is one of the weakest links in the chain (no 2FA, > passwords stored locally in plaintext, etc). Good reminder. > > Cheers > > f > -- > Fernando Perez (@fperez_org; http://fperez.org) > fperez.net-at-gmail: mailing lists only (I ignore this when swamped!) > fernando.perez-at-berkeley: contact me here for any direct mail > > -- > You received this message because you are subscribed to the Google Groups > "Project Jupyter" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To post to this group, send email to [email protected]. > To view this discussion on the web visit https://groups.google.com/d/ > msgid/jupyter/CAHAreOo0nBBx9hYMfY76tctzgunB3xttYeiuZVJN6othY7X1zA%40mail. > gmail.com > <https://groups.google.com/d/msgid/jupyter/CAHAreOo0nBBx9hYMfY76tctzgunB3xttYeiuZVJN6othY7X1zA%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Project Jupyter" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/CAAoBLw287-x2JppuD1sHd7s%2BXWaMzpMEc4Dh8WRuvgZSpzWB-A%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
