unpopular thought perhaps, but with this many companies/teams <i>mandating</i> MFA (especially to technical people, who should already know how to create secure passwords, not use them on more than one site, not spread them around, etc):<p>The pressure of all of these MFA inputs, especially for products that expire them even on a trusted device/browser, is eventually going to push people into the arms of convenient "password managers".<p>This will effectively nullify the 'something you have' in MFA because it'll all be available on your one single device again.<p>Even worse, it'll present <i>multiple</i> high-value targets now, from the centralized server/sync side (ie lastpass) down to individual devices.<p>Put another way: if you're storing the passwords in the same place as the MFA secrets, then it's not actually MFA anymore.<p>It's not that PyPI is wrong to do this, it's that the weight of <i>everyone</i> mandating MFA will eventually either push people away or force them to work around draconian or onerous security requirements.