update about beta status of security-key using webauth (#119)
Monish C Mohan committed
May 11, 2022 at 05:44 UTC
1d55bbb8df2754ed6b11f6606d22ed4676576b7c
3 files changed
+23
-8
content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx
+10
-2
@@ -3,17 +3,24 @@ title: About two-factor authentication
3
redirect_from: [ /getting-started/using-two-factor-authentication ]
4
---
5
6
-Two-factor authentication (2FA) protects against unauthorized access to your account by confirming your identity using:
6
+[Two-factor authentication (2FA)][2fa] protects against unauthorized access to your account by confirming your identity using:
7
8
* Something you know (e.g., a password).
9
* Something you have (e.g., an ID badge or a cryptographic key).
10
* Something you are (e.g., a fingerprint or other biometric data).
11
12
-When you enable 2FA, you will be prompted for a second form of authentication before performing certain actions on your account or packages to which you have write access. Depending on your 2FA configuration you will be either prompted to authenticate with a security-key or a [time-based one-time password (TOTP)][totp].
12
+<Note>
13
+
14
+**Note**: The security-key flow using [WebAuthn][webauthn] is currently in beta.
15
+
16
+</Note>
17
+
18
+When you enable 2FA, you will be prompted for a second form of authentication before performing certain actions on your account or packages to which you have write access. Depending on your 2FA configuration you will be either prompted to authenticate with a [security-key][webauthn] or a [time-based one-time password (TOTP)][totp].
19
20
* The security-key flow allows you to use biometric devices such as Apple [Touch ID][touch-id], [Face ID][face-id] or [Windows Hello][windows-hello] as well as physical keys such as [Yubikey][yubikey], [Thetis][thetis] or [Feitian][feitian] as your 2FA.
21
* To configure TOTP you will need to install an authenticator application that can generate OTPs such as [Authy][authy], [Google Authenticator][google-authenticator], or [Microsoft Authenticator][microsoft-authenticator] on your mobile device.
22
23
+
24
<Note>
25
26
**Note:** Two-factor authentication provides the best possible security for your account against attackers. We strongly recommend enabling 2FA on your account as soon as possible after you sign up.
@@ -79,3 +86,4 @@ If you enable 2FA for authorization only. We will request a second form of authe
86
[thetis]: https://thetis.io/
87
[feitian]: https://www.ftsafe.com/
88
[totp]: https://en.wikipedia.org/wiki/Time-based_one-time_password
89
+[2fa]: https://en.wikipedia.org/wiki/Multi-factor_authentication
content/getting-started/setting-up-your-npm-user-account/accessing-npm-using-2fa.mdx
+1
-1
@@ -3,7 +3,7 @@ title: Accessing npm using two-factor authentication
3
redirect_from: [ /getting-started/using-two-factor-authentication ]
4
---
5
6
-## Sign in from the command line using WebAuthn
6
+## Sign in from the command line using security-key flow
7
8
1. On the command line, type the [`npm login`][login] command.
9
content/getting-started/setting-up-your-npm-user-account/configuring-two-factor-authentication.mdx
+12
-5
@@ -3,18 +3,25 @@ title: Configuring two-factor authentication
3
---
4
import shared from '../../../src/shared.js'
5
6
-You can enable two-factor authentication (2FA) on your npm user account to protect against unauthorized access to your account and packages, either by using a [security key][webauthn] or [time-based one-time password (TOTP)][totp] mobile app.
6
+You can enable two-factor authentication (2FA) on your npm user account to protect against unauthorized access to your account and packages, either by using a [security-key][webauthn] or [time-based one-time password (TOTP)][totp] from a mobile app.
7
+
8
+<Note>
9
+
10
+**Note**: The security-key flow using [WebAuthn][webauthn] is currently in beta.
11
+
12
+</Note>
13
14
## Prerequisites
15
16
Before you enable 2FA on your npm user account, you must:
17
18
* Update your npm client to version 5.5.1 or higher.
13
-* To configure a security key requires a modern browser that support [WebAuthn][can-i-use]. This will allow you to configure a biometric devices such as Apple [Touch ID][touch-id], [Face ID][face-id], or [Windows Hello][windows-hello] as well as physical keys such as [Yubikey][yubikey], [Thetis][thetis], or [Feitian][feitian].
19
+* To configure a security-key requires a modern browser that support [WebAuthn][can-i-use]. This will allow you to configure a biometric devices such as Apple [Touch ID][touch-id], [Face ID][face-id], or [Windows Hello][windows-hello] as well as physical keys such as [Yubikey][yubikey], [Thetis][thetis], or [Feitian][feitian].
20
* To configure TOTP you will need to install an authenticator application that can generate OTPs such as [Authy][authy], [Google Authenticator][google-authenticator], or [Microsoft Authenticator][microsoft-authenticator] on your mobile device.
21
22
For more information on supported 2FA methods, see "[About two-factor authentication][about-two-factor-authentication]".
23
24
+
25
<Note>
26
27
**Note:** npm does not accept SMS (text-to-phone) as a 2FA method.
@@ -45,7 +52,7 @@ For more information on supported 2FA methods, see "[About two-factor authentica
52
53
6. Configure the 2FA method of your choice:
54
48
- * When using a **security key**, provide a name for it and click **Add security key**. Follow the browser specific steps to add your security key.
55
+ * When using a **security-key**, provide a name for it and click **Add security key**. Follow the browser specific steps to add your security-key.
56
57
<Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-add-security-key.png" alt="Screenshot showing security key setup" />
58
@@ -62,7 +69,7 @@ For more information on supported 2FA methods, see "[About two-factor authentica
69
<Screenshot src="/getting-started/setting-up-your-npm-user-account/recovery-code.png" alt="Screenshot showing the Recovery Code page" />
70
71
65
- _Recovery codes are the only way to recover your account if you lose access to your second factor device. There are 5 codes presented and each code can be used only once. You can [view and regenerate your recovery code][viewing-and-regenerating-recovery-code] from your 2FA settings page._
72
+ _Recovery codes are the only way to recover your account if you lose access to your second factor device. Each code can be used only once. You can [view and regenerate your recovery code][viewing-and-regenerating-recovery-code] from your 2FA settings page._
73
74
8. Click **Go back to settings** after confirming that you have saved your codes.
75
@@ -125,7 +132,7 @@ If you have 2FA enabled, you can remove it from your account settings page.
132
133
### Enabling 2FA from the command line
134
128
-Although WebAuthn can be used for authentication from both the web and the command line, it can only be configured from the web. When enabling 2FA from the command line, currently the only available option is to use an TOTP mobile app.
135
+Although security-key with WebAuthn can be used for authentication from both the web and the command line, it can only be configured from the web. When enabling 2FA from the command line, currently the only available option is to use an TOTP mobile app.
136
137
<Note>
138