# Require MFA on PyPI? **URL:** \ **Category:** Packaging\ **Created:** [November 19, 2021, 12:37am UTC](https://discuss.python.org/t/require-mfa-on-pypi/12077 "2021-11-19T00:37:46Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![oscarbenjamin](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/oscarbenjamin/32/1209_2.png) [@oscarbenjamin](https://discuss.python.org/u/oscarbenjamin)\ **Post date:** [November 20, 2021, 10:07pm UTC](https://discuss.python.org/t/require-mfa-on-pypi/12077/21 "2021-11-20T22:07:39Z")
> [@tiran](#): > > Instead of time-scoping I suggest an **optional** two-step release process. In the first step automation uses a project-scoped token to create a new staging release and upload artifacts. In the second a human needs to log-in with MFA and press the release button. The workflow allows users to automate all the annoying bits and still require MFA for the actual release. That sounds perfect to me. Ideally I would like a UI where I can see what files are uploaded and their checksums and I can download them for sanity checking before signing off. I stopped just short of enabling automated uploads for SymPy releases because I didn’t quite figure out a good way to control access for which contributors would be able to trigger the upload process from GHA. When I considered this I was worried about accidental triggers as well as malicious ones. Controlling access at PyPI rather than GHA is much simpler to audit because the number of people with PyPI access is much smaller. I would also be happier working on the release script itself if I knew that the final publish step could not possibly happen automatically (debugging a script that I definitely don’t want to fully execute makes me a bit nervous). I agree that this should be optional but it’s definitely an option I would choose. ---
**Author:** ![pradyunsg](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/pradyunsg/32/206_2.png) [@pradyunsg](https://discuss.python.org/u/pradyunsg)\ **Post date:** [November 23, 2021, 10:15pm UTC](https://discuss.python.org/t/require-mfa-on-pypi/12077/22 "2021-11-23T22:15:17Z")
And… now, we seem to be discussing [Draft release feature on main archive to allow testing a release before it goes live · Issue #726 · pypi/warehouse · GitHub](https://github.com/pypa/warehouse/issues/726) 🙂 > [@Zac-HD](#): > > can I suggest adding MFA-and-token-related enhancements to the [fundables page](https://github.com/psf/fundable-packaging-improvements/blob/master/FUNDABLES.md)? They do seem to meet the criteria, and e.g. the [OpenSSF](https://github.com/ossf) might be interested. Yep, that’s a good idea! I’m not on the PSF’s Packaging-WG (who maintain that repository), though I’m sure a PR would be welcome. ---
**Author:** ![rouilj](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/rouilj/32/5417_2.png) [@rouilj](https://discuss.python.org/u/rouilj)\ **Post date:** [January 30, 2022, 3:16pm UTC](https://discuss.python.org/t/require-mfa-on-pypi/12077/23 "2022-01-30T15:16:54Z")
What about packages that are uploaded with a gpg signature? Wouldn’t validating the signature provide more security than MFA? Isn’t MFA is really a proxy for the security of the package artifact. This would also require pip to download and make validation of signatures easier/automatic but it seems to provide better supply chain validations/security. ---
**Author:** ![fungi](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/fungi/32/5963_2.png) [@fungi](https://discuss.python.org/u/fungi)\ **Post date:** [January 30, 2022, 3:50pm UTC](https://discuss.python.org/t/require-mfa-on-pypi/12077/24 "2022-01-30T15:50:23Z")
[…] The PyPI maintainers have long expressed a dislike for OpenPGP as a means of establishing provenance or attestation for packages. The accepted plan to solve it is instead integration of TUF (The Update Framework) per PEP 458: > **[PEP 458 -- Secure PyPI downloads with signed repository metadata](https://www.python.org/dev/peps/pep-0458/)** > > The official home of the Python Programming Language Authentication of users to the platform serves a separate purpose; it can be used not only to upload new packages, but also to yank or hide existing ones, or to delegate access to other accounts. While I agree that some cryptographic attestation is desirable, it should be in addition to strong authentication of accounts, not as a substitute. ---
**Author:** ![tiran](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/tiran/32/48_2.png) [@tiran](https://discuss.python.org/u/tiran)\ **Post date:** [January 30, 2022, 5:03pm UTC](https://discuss.python.org/t/require-mfa-on-pypi/12077/25 "2022-01-30T17:03:50Z")
PEP 458 and OpenGPG signatures solve two related but different issues. PEP 458 signatures are created by PyPI backend and only protect PyPI storage and downloads from PyPI. PEP 458 does not establish provenance of packages either. ---
**Author:** ![sumanah](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sumanah/32/1722_2.png) [@sumanah](https://discuss.python.org/u/sumanah)\ **Post date:** [April 19, 2022, 2:42pm UTC](https://discuss.python.org/t/require-mfa-on-pypi/12077/26 "2022-04-19T14:42:12Z")
> [@dustin](#): > > …PyPI does not currently have a large support staff like npm/GitHub/Microsoft does. [Account recovery requests](https://github.com/pypa/pypi-support/issues?q=is%3Aissue+is%3Aopen+label%3Aaccount-recovery) due to lost 2FA are already a huge drain on staff/volunteer resources due to how time-consuming they are and their sensitive nature. A 2FA mandate at this time, without having support staff, would likely eventually result in an overwhelming backlog of requests. Yeah. We need better workflow for dealing with account recovery requests (as folks are discussing in [Discussion of long term methods of addressing 2FA Account Recovery Requests · Issue #796 · pypi/support · GitHub](https://github.com/pypa/pypi-support/issues/796) ) and we could really use some paid help as well to work through those requests (in my opinion there’s usually going to need to be SOME human in the loop to check for “hold on, this doesn’t feel right”). Is this something we could raise money for? We could appeal to donors/companies by saying: once we implement a better workflow and hire a paid support person for this, we can help project owners turn on multifactor auth requirements, we can better secure PyPI, which reduces your supply chain risk. @smm maybe this is already in the works and I’m behind the times? ---
**Author:** ![sumanah](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sumanah/32/1722_2.png) [@sumanah](https://discuss.python.org/u/sumanah)\ **Post date:** [April 19, 2022, 4:14pm UTC](https://discuss.python.org/t/require-mfa-on-pypi/12077/27 "2022-04-19T16:14:34Z")
Just did some more reading and caught up a bit: [Add ability to require 2FA for a given project](https://github.com/pypa/warehouse/issues/5792) – this is done as a feature flag, but not yet deployed anywhere, I think. @dustin and @EWDurbin and @woodruffw - is this deployed on Test PyPI, and if not, maybe we should do so? [Require API Tokens for upload if 2FA is enabled](https://github.com/pypa/warehouse/issues/7265) – not yet implemented. That plus other token-related development is now in [the Fundables list](https://github.com/psf/fundable-packaging-improvements/blob/master/FUNDABLES.md#improved-support-for-multi-factor-authentication-in-warehouse-pypi). ---
**Author:** ![dustin](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/dustin/32/149_2.png) [@dustin](https://discuss.python.org/u/dustin)\ **Post date:** [April 19, 2022, 4:32pm UTC](https://discuss.python.org/t/require-mfa-on-pypi/12077/28 "2022-04-19T16:32:24Z")
> [@sumanah](#): > > [Add ability to require 2FA for a given project](https://github.com/pypa/warehouse/issues/5792) – this is done as a feature flag, but not yet deployed anywhere, I think. @dustin and @EWDurbin and @woodruffw - is this deployed on Test PyPI, and if not, maybe we should do so? This is waiting on the rollout of some additional changes to be launched simultaneously: [Models, views, tasks, etc for critical projects promo by di · Pull Request #10856 · pypi/warehouse · GitHub](https://github.com/pypa/warehouse/pull/10856) > [@sumanah](#): > > [Require API Tokens for upload if 2FA is enabled](https://github.com/pypa/warehouse/issues/7265) – not yet implemented. That plus other token-related development is now in [the Fundables list](https://github.com/psf/fundable-packaging-improvements/blob/master/FUNDABLES.md#improved-support-for-multi-factor-authentication-in-warehouse-pypi). It’s essentially done, we just need to change the current notification of pending failure to an actual failure. Since we notified on Feb 25th, I think a ~6 month window suffices and we can resolve this sometime after Aug 25. ---
**Author:** ![EWDurbin](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/ewdurbin/32/3103_2.png) [@EWDurbin](https://discuss.python.org/u/EWDurbin)\ **Post date:** [April 19, 2022, 7:51pm UTC](https://discuss.python.org/t/require-mfa-on-pypi/12077/29 "2022-04-19T19:51:02Z")
> [@sumanah](#): > > Is this something we could raise money for? We could appeal to donors/companies by saying: once we implement a better workflow and hire a paid support person for this, we can help project owners turn on multifactor auth requirements, we can better secure PyPI, which reduces your supply chain risk. I’ll let @smm expand on the project more thoroughly, but the scope in [this RFP](https://github.com/psf/request-for/blob/main/2022-PyPI/RFP.md#scope), which is [underway](https://discuss.python.org/t/pypi-organization-account-project-update/14913) is intended to build a more sustainable PyPI by delivering features that the PSF can provide to companies at a cost and community organizations for-free. Part of this will _require_ additional paid staff to support PyPI in the future, not only for paying customers but for the community. If PyPI’s revenue from Organization Accounts and additional developed features aren’t enough, the PSF will certainly look to fundraise to better support _all_ users of PyPI, that is a basis of sustainability for the service. And as a more short-term relief, although once again… only a small portion of the role, the upcoming [Infrastructure staff hire](https://pyfound.blogspot.com/2022/03/we-are-hiring-to-expand-our.html) will be brought up to speed to provide some of the support I currently do to help ease the current bottle neck (me). [Previous page](https://discuss.python.org/t/require-mfa-on-pypi/12077.md?page=1)