Opt-in for MFA requirement

[tagliala]

Make the gem more secure by requiring that all privileged operations by any of the owners require OTP.

Ref: https://guides.rubygems.org/mfa-requirement-opt-in/

---

I've seen that there is not a clear preference of " above ', so I'm using '

[boazsegev]

What's the up-side of increased security?

I understand it potentially protects users against supply-chain attacks... but it requires me to provide additional private data (i.e., phone number), does it no?

Will 2FA become a gem requirement at some point?

The biggest question I have about this is that someone can push a version by simply removing the line from the gemspec file (which translates to an insecure state)...?

[tagliala]

Hi,

A little bit of background. I'm proposing this change for some gems that I may use in my stack

MFA is already been used by popular Ruby gems like rails, puma, nokogiri, dalli, and recently has been accepted by sidekiq

There is also a RuboCop cop checking for the MFA in the gemfile: https://docs.rubocop.org/rubocop/cops_gemspec.html#gemspecrequiremfa

I understand it potentially protects users against supply-chain attacks... but it requires me to provide additional private data (i.e., phone number), does it no?

I'm using an authenticator app, no SMS involved. I've checked my profile at rubygems and there is no phone number field available. At the best of my knowledge, I did not provide them my phone number

More information about rubygems and MFA at: https://guides.rubygems.org/setting-up-multifactor-authentication/

Will 2FA become a gem requirement at some point?

At the moment it is mandatory for top 100 gems and maintainers of popular gems

https://blog.rubygems.org/2022/08/15/requiring-mfa-on-popular-gems.html

The biggest question I have about this is that someone can push a version by simply removing the line from the gemspec file (which translates to an insecure state)...?

As per https://guides.rubygems.org/mfa-requirement-opt-in/ and https://guides.rubygems.org/mfa-requirement-opt-in/#disabling-mfa-requirement

The version being released with rubygems_mfa_required set and all the following version will require that you provide an OTP for all privileged operations ... You can disable the MFA requirement by setting rubygems_mfa_required to "false" or any ActiveRecord::Type::Boolean::FALSE_VALUES.

At the best of my understanding, I think that this change is irreversible. this can be disabled by successfully pushing a gem with MFA metadata set to false (by providing a legit OTP code, so it needs 2FA to disable 2FA)