PyPI or the Python Package Index is giving away 4,000 Google Titan security keys as part of its move to mandatory two-factor authentication (2FA) for critical projects built in the Python programming language.  Python is one of the world’s most popular programming languages, loved for its breadth of packages or add-on libraries that make it useful for data science. Developers need to update these packages frequently and attackers have used this behavior to backdoor their Windows, Linux and Apple machines through bogus packages that are similarly named to legitimate ones, otherwise known as software supply chain attacks. PyPI, which is managed by the Python Software Foundation, is the main repository where Python developers can get third-party developed open-source packages for their projects. PyPI and JavaScript’s equivalent npm repository act like the App Store/Play Store for developers, but aren’t closed and the free services don’t have the resources to vet package submissions for malware. Google, through the Linux Foundation’s Open Source Security Foundation (OpenSSF), is tackling the threat of malicious language packages and open source software supply chain attacks. It found over 200 malicious JavaScript and Python packages in one month and noted “devastating consequences” for developers and the organizations they write code for when they install them.  One way developers can protect themselves from stolen credentials is by using two-factor authentication and the PSF is now making it mandatory for developers behind “critical projects” to use 2FA in coming months. PyPI hasn’t declared a specific date for the requirement.”We’ve begun rolling out a 2FA requirement: soon, maintainers of critical projects must have 2FA enabled to publish, update, or modify them,” the PSF said on its PyPI Twitter account. As part of the security drive, it is giving away 4,000 Google Titan hardware security keys to project maintainers gifted by Google’s open source security team. “In order to improve the general security of the Python ecosystem, PyPI has begun implementing a two-factor authentication (2FA) requirement for critical projects. This requirement will go into effect in the coming months,” PSF said in a statement.  “To ensure that maintainers of critical projects have the ability to implement strong 2FA with security keys, the Google Open Source Security Team, a sponsor of the Python Software Foundation, has provided a limited number of security keys to distribute to critical project maintainers.PSF says it deems any project in the top 1% of downloads over the prior six months as critical. Presently, there are more than 350,000 projects on PyPI, meaning that more than 3,500 projects are rated as critical. PyPI calculates this on a daily basis so the Titan giveaway should go a long way to cover a chunk of key maintainers but not all of them. In the name of transparency, PyPI is also publishing 2FA account metrics here. There are currently 28,336 users with 2FA enabled, with nearly 27,000 of them using a 2FA app like Microsoft Authenticator. There are over 3,800 projects rated as “critical” and 8,241 PyPI users in this group. The critical group is also likely to grow since projects that have been designated as critical remain so indefinitely while new projects are added to mandatory 2FA over time. The 2FA rule applies to both project maintainers and owners. Titan keys are only approved for sale in certain geographic regions, so only developers from Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, United Kingdom, and the United States are eligible to receive a free one, according to PyPI. Maintainers in other regions who will be required to use 2FA need to buy a FIDO U2F security key from vendors like Yubikey. Or they can enable 2FA through a mobile app like Google Authenticator, Microsoft Authenticator, Duo Mobile, Auth, FreeOTP+ or FreeOTP or a password manager like 1Password. Eligible maintainers can redeem a promo code for two free Titan Security Keys (USB-C or USB-A), including free shipping from the PyPI website. The code expires on October 1. While most developers will be familiar with 2FA, the requirement could create log-in challenges, say if a user loses the 2FA key and has set up their account with only one 2FA option. “Without multiple 2FA options, effect of losing a 2FA method results in the need to fully recover an account, which is burdensome and time-consuming both for maintainers and PyPI administrators. Enabling multiple 2FA methods reduces the potential disruption if one is lost,” PyPl warns. More

<!–> Boris Zhitkov/Getty Images Ransomware attacks reached record levels in July 2023, driven by the Cl0p ransomware group’s exploitation of MOVEit software.  In a new report released by NCC Group’s Global Threat Intelligence team, analysts observed a record number of ransomware-related cyberattacks last month, with 502 major incidents tracked. According to the researchers, this represents […] More

Creative Aurvana Ace 3 earbuds <!–> ZDNET’s key takeaways The Creative Aurvana Ace 3 earbuds are available in the EU for $149. These earbuds deliver brilliant sound unheard of at this price point. You will need to walk through the personalization feature to get the best sound. –> Follow ZDNET: Add us as a preferred source<!–> on […] More

Cyber-security experts have revealed today 19 vulnerabilities in a small library designed in the 90s that has been widely used and integrated into countless of enterprise and consumer-grade products over the last 20+ years. The number if impacted products is estimated at “hundreds of millions” and includes products such as smart home devices, power grid […] More

Javier Zayas Photography/Moment via Getty Images Follow ZDNET: Add us as a preferred source<!–> on Google. ZDNET’s key takeaways Google’s state-of-the-art image model is available for all. It first became famous under the codename “nano-banana.” The model now comes with 10 different aspect ratios. Gemini 2.5 Flash Image, Google’s state-of-the-art image-generating AI model otherwise known as “nano […] More