Top-500 NPM package maintainers now require 2FA
I feel like there are still too many hands in this particular cookie jar. MFA or no. On average, how many other organizations &amp; human developers are somehow involved in the dependency graph of a modern node.js project?<p>I fail to see how MFA resolves the fundamental trust equation. Bad code is bad code, doesn&#x27;t matter what the authentication system says about the actor&#x27;s identity. I can create 2FA-enabled GH accounts all day named after JK Rowling characters without anyone at GH sending me a security nastygram or banning me for identity violations.<p>Until GitHub requires government-issued photo ID <i>in addition to</i> MFA, I don&#x27;t think you are going to properly discourage bad or criminal actors. To be clear: I strongly disagree with any notion that GitHub should <i>require</i> photo ID to open an account. But, perhaps a &quot;verified user&quot; option (extending to &quot;verified org&quot; if all users are compliant) might provide another path.