> The most important things you can do to prepare are to enable 2FA for your account as soon as possible, either with a security device (preferred) or an authentication app and to switch to using either Trusted Publishers (preferred) or API tokens to upload to PyPI.
So you either need to have a mobile phone (all of the linked applications[0] seem to require an Android or iOS device) or some custom device and they prefer you to rely on some 3rd party they call "Trusted Publisher"?
Weren't private+public key signatures invented for solving pretty much this thing? They might be a bit complex for Mere Mortals but programmers should at least be able to figure them out. Am i missing something?
EDIT: seems like TOTP is indeed similar to private+public key signatures (in that there is a shared secret to check against), can be done fully locally without requiring a phone or any 3rd party service and it just happened that the applications listed on the site were all for phones.
>
> The most important things you can do to prepare are to enable 2FA for your account as soon as possible, either with a security device (preferred) or an authentication app and to switch to using either Trusted Publishers (preferred) or API tokens to upload to PyPI.
So you either need to have a mobile phone (all of the linked applications[0] seem to require an Android or iOS device) or some custom device and they prefer you to rely on some 3rd party they call "Trusted Publisher"?
Weren't private+public key signatures invented for solving pretty much this thing? They might be a bit complex for Mere Mortals but programmers should at least be able to figure them out. Am i missing something?
EDIT: seems like TOTP is indeed similar to private+public key signatures (in that there is a shared secret to check against), can be done fully locally without requiring a phone or any 3rd party service and it just happened that the applications listed on the site were all for phones.
[0] https://pypi.org/help/#totp