notes
totp
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
notes
-
GitHub will require 2FA by the end of 2023
This change would certainly have helped against the infamous "Gathering weak npm credentials" research[0] from 2017, but I think that most recent supply chain security issues (in NPM, at least) have been due to: 1) typosquatting, 2) developers deliberately adding malicious (or unwanted) code into their own packages, and 3) deep transitive dependencies on packages that have genuine bugs that lead to vulnerabilities.
It's not clear that this 2FA requirement would fix any of those problems, but it could one day allow package management tools to flag up when one developer has given/sold control of their package over to someone else who has less of a reputation and might be malicious, as was the case with the event-stream package.[1]
[0] https://github.com/ChALkeR/notes/blob/master/Gathering-weak-...
[1] https://www.eweek.com/security/node.js-event-stream-hack-exp...
-
Securities in NodeJs
According to one research, 14% of the Node Package Manager is affected with some or the other security issues. So, what is the cause of these security issues?
-
A series of unfortunate commits: notable software security stories
In 2015, Nikita Andreevich Skovoroda, a member of the Node.js Technical Steering Committee, performed a scan on GitHub search and npm. Afterwards, he was able to obtain over 100 passwords and nearly 200 tokens for accounts associated with a number of frequently installed packages.
totp
- SMS Pumping Attack
-
Best TOTP Authenticator for desktop?
here's a command line one https://github.com/arcanericky/totp
-
GitHub will require 2FA by the end of 2023
TOTP never requires a phone number. On GitHub, they either show you a qr code you can scan in an app, or a text you can import. All apps support this sign up process, from google authenticator to console-based tools like totp[0].
Other 2FA may require phone numbers.
[0]: https://github.com/arcanericky/totp
-
What are your guy's reasons for self hosting? Particularly cloud services.
I rolled my own by wrapping a UI around this awesome little go utility... https://github.com/arcanericky/totp
What are some alternatives?
php-docker - Docker Official Image packaging for PHP
2fast - Two-Factor Authenticator Supporting TOTP (Windows 10 & Android, iOS, Linux and macOS App)
otplib - :key: One Time Password (OTP) / 2FA for Node.js and Browser - Supports HOTP, TOTP and Google Authenticator
speakeasy - **NOT MAINTAINED** Two-factor authentication for Node.js. One-time passcode generator (HOTP/TOTP) with support for Google Authenticator.
OTPClient - Highly secure and easy to use OTP client written in C/GTK3 that supports both TOTP and HOTP
2FAuth - A Web app to manage your Two-Factor Authentication (2FA) accounts and generate their security codes
totp-generator - Generate TOTP tokens from key
otpgo - Time-Based One-Time Password (TOTP) and HMAC-Based One-Time Password (HOTP) library for Go.
2ami - Your easy 2FA companion that keep the secrets secret.
authy - Go library and program to access your Authy TOTP secrets.
authelia - The Single Sign-On Multi-Factor portal for web apps
scram-password - Command-line utility for Postgres-compatible SCRAM-SHA-256 passwords