News for hackers. Stuff that matters.
Re:Requiring MFA on popular gem maintainers by nisegami on Tuesday August 16, 2022 @10:33AM (#32483258)
The irony is of course that you're now back to a single factor if you store your TOTP secrets in your password manager.

But a good single factor is probably fine.

Re:Requiring MFA on popular gem maintainers by giaour on Tuesday August 16, 2022 @10:38AM (#32483319)
It's only a single factor if your password manager login is compromised. If you're instead the victim of a phishing attack or you somehow spill the password + an MFA token for a single service, then you still get some of the protections you would expect from MFA (e.g., the leaked login will be time-boxed and non-renewable).
Re:Requiring MFA on popular gem maintainers by worble on Tuesday August 16, 2022 @10:39AM (#32483348)
To be honest, the most likely surface of attack for a user are database leaks. So long as your password manager is uncompromised, even if someone does manage to get ahold of your username/password for a specific site they won't get anywhere.