Require 2FA to be enabled on Github to protect against password reuse

[Shnatsel]

Is your feature request related to a problem? Please describe.

The notorious ESLint compromise was attributed to password reuse. Currently crates.io does not protect from password reuse in any way.

Describe the solution you'd like

crates.io should require two-factor authentication to be enabled in the Github account in order to log in to crates.io.

While there seems to be no way to ask Github to perform 2FA, it is possible to query whether the user has 2FA enabled and refuse login attempts from people who do not have 2FA enabled. This is sufficient to protect from password reuse.

Describe alternatives you've considered

It would be nice to ask Github to perform 2FA when logging in to crates.io because that would also protect from Github cookie theft, but that doesn't appear to be possible - I could not find any Github API endpoints to do so.

Additional context

Supply chain attacks are becoming increasingly commonplace. Just last month four high-profile NPM packages have been compromised, with the ua-parser-js being the most widely used.

See also: #4196, #4197 for other basic mitigations. No single one is sufficient on its own; they have to be used in tandem.

[ssokolow]

For anyone who might be be reluctant to support this idea based on privacy concerns, I can confirm that GitHub's 2FA implementation doesn't try to push you to overshare.

• It doesn't demand that you tell them an SMS number.
• If you choose to use an authenticator app, it offers both a QR code for mobile apps and a link to display the raw TOTP secret to be pasted into desktop apps.
• It supports WebAuthn security keys, which means that, even if you want to go for a big-name brand like Yubikey, you can go for their inexpensive $25 USD "no TOTP, HOTP, PIV, or PGP, but we'll give you FIDO/U2F and FIDO2/CTAP/WebAuthn" for-the-masses keys. (I've just ordered a couple of those to up my own security and Yubico has an official Amazon store, so you can get free shipping and a Verify your YubiKey page if you're worried about Amazon's counterfeit-prone "one SKU, one bin" warehousing of Amazon Marketplace stuff that's Fulfilled by Amazon.)