https://blog.rubygems.org/2022/08/15/requiring-mfa-on-popular-gems.html

 RubyGems Navigation menu
[                    ] Search gems [[?]]
Gems Guides Contribute

Blog

Back to blog posts

15 Aug 2022

Requiring MFA on popular gem maintainers

by Jenny Shen

      Doodle of a RubyGem wearing a MFA hat, giving a thumbs up

Two months ago, we outlined our commitment to making Ruby's supply
chain more secure. To combat account takeovers -- the second most
common software supply chain attack -- we announced a policy to
require multi-factor authentication (MFA) on at least the top-100
RubyGems packages.

Today (August 15th, 2022), we will begin to enforce MFA on owners of
gems with over 180 million total downloads. Users in this category
who do not have MFA enabled on the UI and API or UI and gem signin
level will not be able to edit their profile on the web, perform
privileged actions (i.e. push and yank gems, or add and remove gem
owners), or sign in on the command line until they configure MFA.

Maintainers of gems that surpass 165 million total downloads will
continue to receive recommendation reminders on the UI and CLI until
the gem reaches 180 million total downloads. At that point, MFA will
be required.

This policy would bring us in line with the policies made by other
package ecosystems. We have plans to increase MFA adoption on
RubyGems. If you have ideas on how future rollouts should be
approached, join this discussion in our RFC repository!

In addition, we are also currently working on adding support for
WebAuthn. Maintainers would be able to use hardware tokens, biometric
keys, and other WebAuthn-supported devices as their multi-factor
device of choice.

Be sure to stay tuned for updates! As always, if you have any
feedback, questions or ideas on how to make RubyGems better and more
secure, please contact us in the Bundler Slack workspace or open a
GitHub issue. If you require account assistance based on the changes
rolled out today, please reach out to support@rubygems.org.

Jenny Shen

2022 2021 2020 2019 2018 2017 2016 2015 2014 2013 2012 2011 2010 2009
2008 2007 2006 2005 2004
Status Uptime Code Data Discuss Stats Blog About Help API

RubyGems.org is the Ruby community's gem hosting service. Instantly
publish your gems and install them. Use the API to interact and find
out more information about available gems. Become a contributor and
enhance the site with your own changes.

Supported by Ruby Central Supported by Ruby Together Designed by 
DockYard Resolved with DNSimple Optimized by New Relic Monitored by 
Datadog Monitored by Runscope Gems served by Fastly Monitored by 
Honeybadger