Ensure 2FA is enabled!

[ewdurbin]

All members of the python organization will soon be required to have 2FA enabled.

Currently some members of @python/python-core and @python/python-triage do not have 2FA enabled.

At your earliest convenience, please go to your account security settings and ensure that the “Two-factor authentication” section shows “Enabled”.

If not, please enable 2FA for your GitHub account according to GitHub's documentation. Be sure to save your recovery codes somewhere safe while doing so!

[hugovk]

In case it's useful, I write a little script when we were enabling 2FA at work, to check which members of the org didn't have 2FA turned on yet, so I could go and hassle remind them:

https://github.com/hugovk/github-tools/blob/main/org_users_2fa.py

[arhadthedev]

to check which members of the org didn't have 2FA turned on yet

What's about Bedevere and Miss Islington? I'm working on triggering the former via GitHub Actions but we still need an account token to work with GitHub REST API. [edit: unless we want to deal with @actions/core, @actions/github and possibly few more JavaScript libraries]

[ewdurbin]

@arhadthedev discussion here: python/bedevere#531

[CAM-Gerlach]

To note, GitHub has been steadily rolling out 2FA for all users, starting with the maintainers of depended-upon projects a couple weeks ago, and concluding with all users by the end of the year. This will include all of us, so all CPython core team members (Triager, Core Dev, etc) will need to have 2FA enabled by around the end of April to continue using their GitHub account.

[menkotoglou]

Following @CAM-Gerlach latest comment, is it required that all CPython core team members have 2FA enabled? If so, could this issue close?

[hugovk]

It will soon be required.

This at least depends on python/bedevere#569 to resolve python/bedevere#531.

[ambv]

Using @hugovk's script, there are still 13 team members without 2FA:

• @aeros
• @akulakov
• @bitdancer
• @ctismer
• @davidmalcolm
• @ericvsmith
• @jcea
• @jdemeyer
• @jeremyhylton
• @LauraGraves
• @sunmy2019
• @terryjreedy
• @theller

[sunmy2019]

Done

[vstinner]

If these core devs enable 2FA later, they can again merge pull requests?

[hugovk]

Yes, but:

If they don't enable 2FA before we require it for the org, they're removed from the org.

If they enable within 3 months, we can reinstate them with the earlier permissions/settings.

If they enable after that, we can re-add them as if they're a new user.

When you require use of two-factor authentication for your organization, members, outside collaborators, and billing managers who do not use 2FA will be removed from the organization and lose access to its repositories. They will also lose access to their forks of the organization's private repositories. You can reinstate their access privileges and settings if they enable two-factor authentication for their personal account within three months of their removal from your organization.

https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization

This isn't necessarily a bad thing, because it can be good for security to remove access when it's not used. And it's not permanent, so can be re-added.

[vstinner]

Are you going to contact them? I know a few of them.