Pretty much this; There are some people who believe that efforts to improve supply chain security benefits only corporate or business users, and that individual developers should not be asked to take on a uncompensated burden for their benefit.
I presume package authors are likely to be rather better informed than this?
https://nakedsecurity.sophos.com/2017/07/11/two-factor-via-y...
I use 2FA on many of my accounts, and it's not that bad if you're only being prompted for it once a week or so.
So, dumping hours upon hours of work into publishing a project on PyPI is fine, but setting up TOTP is where some people draw the line? To prevent against a commonly-exploited attack vector that is so simple to mitigate?
Like... Really?
Not offering an opinion on whether it's good or bad that it's enforced, but that's the difference between the two.
The biggest issue is that as the number of sites in the Authenticator grows finding them becomes more annoying.
Keys are a pain in the ass though, as their form factors usually make them impossible to keep attached to a laptop (as they snag and break if you forget to unplug them before putting the laptop in a bag), yet easy to lose if you’re not super careful.
There are low-profile keys (yubikey’s nanos) but they’re not exactly cheap, and I’ve never seen one being given out (whereas I have free keys from older programs of github and google both).
They’re all minor gripes, but they’re routine annoyances nonetheless, and as the number of sites requiring 2FA grows (rightfully so) the likelihood that you’ll meet a 2FA prompt every day closes in on 1.
And there’s a handful of sites which are really shit about it, with way too aggressive requirements and way too short sessions.
I’ve got great hopes for TPM WebAuthn.