Login with 2FA still triggers confirmation via email

[mfouesneau]

Describe the bug
When logging in to my account, I use password and one-time-password. I received a messaged

Please confirm this login
We noticed you are attempting to log in from a new or previously unrecognized device. To ensure this is you, please check your email for a login confirmation link.
You should have received an email from noreply@pypi.org with the subject line "Unrecognized login to your PyPI account".
In the future, you can automatically trust new devices without needing email verification by using a security device as your 2FA method. See https://pypi.org/help/#utfkey for more details.

Expected behavior
I would assume this was not happening with 2FA login.

To Reproduce
I honestly do not know how to reproduce. It seems to be a timing of inactivity, because I always use the same device or same few IPs

My Platform
Mac OS 26.5.2
Chrome 150.0.7871.115

Additional context
I did not find similar issues, sorry if I missed it.

[kytta]

(Note: I am not a maintainer, but a drive-by triager)

I believe this is intended. Mike mentioned this in his EuroPython talk a few days ago: This is a safety hatch for the cases where the attacker intercepts the whole communication with PyPI and could phish the TOTP code. Due to the fact that your end user device probably doesn't have a fixed IP address, it becomes "unrecognized" more often than you would wish for :/

The solution would be to switch to WebAuthn (passkeys, YubiKey, anything FIDO2-based); those are not phishable and would not trigger this email

[mfouesneau]

At least, would it be good to change the message from an error to a feature?