unpopular thought perhaps, but with this many companies/teams
mandating MFA (especially to technical people, who should already know how to create secure passwords, not use them on more than one site, not spread them around, etc):
The pressure of all of these MFA inputs, especially for products that expire them even on a trusted device/browser, is eventually going to push people into the arms of convenient "password managers".
This will effectively nullify the 'something you have' in MFA because it'll all be available on your one single device again.
Even worse, it'll present multiple high-value targets now, from the centralized server/sync side (ie lastpass) down to individual devices.
Put another way: if you're storing the passwords in the same place as the MFA secrets, then it's not actually MFA anymore.
It's not that PyPI is wrong to do this, it's that the weight of everyone mandating MFA will eventually either push people away or force them to work around draconian or onerous security requirements.
The pressure of all of these MFA inputs, especially for products that expire them even on a trusted device/browser, is eventually going to push people into the arms of convenient "password managers".
This will effectively nullify the 'something you have' in MFA because it'll all be available on your one single device again.
Even worse, it'll present multiple high-value targets now, from the centralized server/sync side (ie lastpass) down to individual devices.
Put another way: if you're storing the passwords in the same place as the MFA secrets, then it's not actually MFA anymore.
It's not that PyPI is wrong to do this, it's that the weight of everyone mandating MFA will eventually either push people away or force them to work around draconian or onerous security requirements.