Raising the bar for software security: GitHub 2FA begins March 13 • Hacker News Board

Re: Raising the bar for software security: GitHub 2FA begins March 13

#11

Post by loloquwowndueo » Thu, Mar 09, 2023, 5:30 PM UTC

rightbyte wrote: post #3

This is just shenanigans to get our phone numbers. As if forcing keys over password was not bad enough. I wonder if I will be able to connect and pull from a private repository without 2FA. Otherwise my personal web server setup breaks.

You don’t need to provide a phone number to enable 2FA. GitHub supports OATH applications that generate one-time codes and webauthn so you can use it with a yubikey and not bother with pesky codes.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#12

Post by 0xffff2 » Thu, Mar 09, 2023, 5:30 PM UTC

Absolutely insane. Why does Github even care whether I use 2FA?

Re: Raising the bar for software security: GitHub 2FA begins March 13

#13

Post by yakkityyak » Thu, Mar 09, 2023, 5:30 PM UTC

GitHub is also one of the few big sites that support Passkeys for 2FA. You can use your Trusted Platform Module, Yubikey, or any Secure Enclave equipped Mac to 2FA.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#14

Post by demindiro » Thu, Mar 09, 2023, 5:30 PM UTC

From a cursory read the options for 2FA are:

- SMS

- Mobile app

What if someone doesn't have a phone?

Re: Raising the bar for software security: GitHub 2FA begins March 13

#15

Post by wiredfool » Thu, Mar 09, 2023, 5:30 PM UTC

edflsafoiewq wrote: post #9

I don't want my phone in any way involved in login. Can I still use Github?

Webauthn works, as does TOTP.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#16

Post by sundaeofshock » Thu, Mar 09, 2023, 5:31 PM UTC

rightbyte wrote: post #3

This is just shenanigans to get our phone numbers. As if forcing keys over password was not bad enough. I wonder if I will be able to connect and pull from a private repository without 2FA. Otherwise my personal web server setup breaks.

You are not required to use your phone number for 2FA. In fact, they discourage users from using SMS for 2FA.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#17

Post by bob1029 » Thu, Mar 09, 2023, 5:31 PM UTC

hank_z wrote: post #6

A quick off topic question related to 2FA. If an employee is required to complete the 2FA to access to the company's system, is the company responsible to provide the employee a necessary device (either phone or hardware token) to complete the 2FA?

We are factoring this into our "should we buy company iPhones for all employees?" conversation right now.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#18

Post by BozeWolf » Thu, Mar 09, 2023, 5:32 PM UTC

edflsafoiewq wrote: post #9

I don't want my phone in any way involved in login. Can I still use Github?

Yes. With totp. For example with the bitwarden browser plugin: https://bitwarden.com/help/authenticator-keys/

Re: Raising the bar for software security: GitHub 2FA begins March 13

#19

Post by [deleted] » Thu, Mar 09, 2023, 5:32 PM UTC

wiredfool wrote: post #15

edflsafoiewq wrote: post #9

I don't want my phone in any way involved in login. Can I still use Github?

Webauthn works, as does TOTP.

[deleted]

Re: Raising the bar for software security: GitHub 2FA begins March 13

#20

Post by psanford » Thu, Mar 09, 2023, 5:32 PM UTC

demindiro wrote: post #14

From a cursory read the options for 2FA are: - SMS - Mobile app What if someone doesn't have a phone?

You can use a FIDO2 key, a built-in platform authenticator, or a desktop TOTP application.