From the GitHub README:<p>> PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained.<p>Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII like a phone number), it takes like 10 seconds to set up, and it protects your packages from hackers. Perhaps the author simply doesn't see the point of 2FA, since he implies the PyPI authors only did it for compliance reasons (and not for normal bolt-your-doors security reasons, which is more likely)?<p>He calls setting up 2FA "an expense of my free time" when surely it took more time for him to delete and re-add his package than it would have to just set up 2FA.<p>EDIT:<p>To be fair, the maintainer owes us nothing[2], sure. But it's not unreasonable to protect the larger community with basic security practices, either.<p>1: <a href="https://pypi.org/help/#twofa" rel="nofollow">https://pypi.org/help/#twofa</a><p>2: <a href="https://gist.github.com/richhickey/1563cddea1002958f96e7ba95" rel="nofollow">https://gist.github.com/richhickey/1563cddea1002958f96e7ba95</a>...