GitHub supports Universal 2nd Factor authentication

#1

Post by mastahyeti » Thu, Oct 01, 2015, 5:03 PM UTC

GitHub supports Universal 2nd Factor authentication
github.com

Re: GitHub supports Universal 2nd Factor authentication

#2

Post by dankohn1 » Thu, Oct 01, 2015, 5:11 PM UTC

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work.

Is a separate USB key meaningfully more secure?

Re: GitHub supports Universal 2nd Factor authentication

#3

Post by jasoncartwright » Thu, Oct 01, 2015, 5:47 PM UTC

dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

I've used a YubiKey for 2FA for a year or so now. It just sits in my USB port and it feels too convenient - steal my laptop and you get my key. At least my phone has a PIN.

Re: GitHub supports Universal 2nd Factor authentication

#4

Post by efm » Thu, Oct 01, 2015, 5:52 PM UTC

dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

Github will support a token generating app on your phone: https://help.github.com/articles/providing-your-2fa-authenti...

Re: GitHub supports Universal 2nd Factor authentication

#5

Post by dudus » Thu, Oct 01, 2015, 5:52 PM UTC

dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

This is actually more convenient sometimes. I already have one of these FOBs permanently attached to my computer. It's a tiny pieces that fit into usb and only protrudes a couple of milimiters. Since I have this always connected all I have to do is touch it and I'm in. Takes me less than once second while taking my phone, opening the app and typing the code by hand takes 10-20 seconds.

The downside is that it takes a USB port, which is one of the reasons I hated this years MacBook so much.

UPDATE: I found the exact model I have on Amazon

http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7...

Re: GitHub supports Universal 2nd Factor authentication

#6

Post by dudus » Thu, Oct 01, 2015, 5:52 PM UTC

dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

This is actually more convenient sometimes. I already have one of these FOBs permanently attached to my computer. It's a tiny pieces that fit into usb and only protrudes a couple of milimiters. Since I have this always connected all I have to do is touch it and I'm in. Takes me less than once second while taking my phone, opening the app and typing the code by hand takes 10-20 seconds.

The downside is that it takes a USB port, which is one of the reasons I hated this years MacBook so much.

UPDATE: I found the exact model I have on Amazon

http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7...

Re: GitHub supports Universal 2nd Factor authentication

#7

Post by WorldMaker » Thu, Oct 01, 2015, 5:57 PM UTC

dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

From another angle they are more convenient:

Most of the USB keys are in a form factor that fits well on an existing key ring. If you are like most people, you presumably also already have a pile of keys connected to a key ring on you at all times.

You don't have to unlock your phone device and launch the appropriate app, you just need to plug into an open USB slot on the machine you are using.

Re: GitHub supports Universal 2nd Factor authentication

#8

Post by chedabob » Thu, Oct 01, 2015, 6:01 PM UTC

I can't think of a single compelling reason to use this over Google Authenticator.

Re: GitHub supports Universal 2nd Factor authentication

#9

Post by calebegg » Thu, Oct 01, 2015, 6:01 PM UTC

dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

OTP based 2FA is susceptible to phishing and MITM attacks. U2F is phish-proof and makes MITM more difficult.

For computers you frequently use, you can get multiple keys and leave them in the port (Yubico makes a small one that stays in the port and only sticks out enough for you to be able to touch it, but it's a bit pricey).

Re: GitHub supports Universal 2nd Factor authentication

#10

Post by bhuga » Thu, Oct 01, 2015, 6:03 PM UTC

dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

Yubikey has a "always available" form factor if you're already bringing your laptop to work in the neo-n: http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7.... It just lives in your USB port.

The user experience is also better with U2F than previous 2FA systems. When GitHub prompts you for U2F, you press the yubikey and are instantly logged in. No typing random numbers with n seconds, no fake keyboard.

YMMV of course, but if you've tried U2F, it feels incredibly slick.