Raising the bar for software security: GitHub 2FA begins March 13 • Hacker News Board

Re: Raising the bar for software security: GitHub 2FA begins March 13

#21

Post by HeckFeck » Thu, Mar 09, 2023, 5:32 PM UTC

sundaeofshock wrote: post #16

rightbyte wrote: post #3

This is just shenanigans to get our phone numbers. As if forcing keys over password was not bad enough. I wonder if I will be able to connect and pull from a private repository without 2FA. Otherwise my personal web server setup breaks.

You are not required to use your phone number for 2FA. In fact, they discourage users from using SMS for 2FA.

I wish the makers of Google Suite thought the same way.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#22

Post by hank_z » Thu, Mar 09, 2023, 5:32 PM UTC

0xffff2 wrote: post #7

hank_z wrote: post #6

A quick off topic question related to 2FA. If an employee is required to complete the 2FA to access to the company's system, is the company responsible to provide the employee a necessary device (either phone or hardware token) to complete the 2FA?

In what way? Morally and ethically, I think you're going to get a resounding yes from people here. Legally, I very much doubt it, but I am not a lawyer.

Legally. In my opinion, if something is required for a worker to finish the job, the employer is obligated to provide it for free. I could be wrong. Curious to know other people's thought.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#23

Post by yakkityyak » Thu, Mar 09, 2023, 5:33 PM UTC

0xffff2 wrote: post #12

Absolutely insane. Why does Github even care whether I use 2FA?

It looks like it's for accounts that contribute code. Compromised accounts can sneak malicious stuff into dependencies.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#24

Post by tekla » Thu, Mar 09, 2023, 5:33 PM UTC

rightbyte wrote: post #3

This is just shenanigans to get our phone numbers. As if forcing keys over password was not bad enough. I wonder if I will be able to connect and pull from a private repository without 2FA. Otherwise my personal web server setup breaks.

Good thing I dont need to use my phone number

Re: Raising the bar for software security: GitHub 2FA begins March 13

#25

Post by wiredfool » Thu, Mar 09, 2023, 5:33 PM UTC

sdfhbdf wrote: post #4

This is a step in the right direction. Although if i’m not mistaken the case for somebody stealing your .ssh directory with keys and contributing to GitHub over SSH still stands. I guess it’d be hard to require everybody to password protect their ssh keys.

I suspect that if your main branch was protected, an attacker would be restricted to branches that require active access to automatically get into a distribution.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#26

Post by capableweb » Thu, Mar 09, 2023, 5:33 PM UTC

> Enroll second factors. Having more accessible 2FA methods is important to ensure that you always have access to your account. You can now have both an authenticator app (TOTP) and an SMS number registered on your account at the same time. While we recommend using security keys and your TOTP app over SMS, allowing both at the same time helps reduce account lock out by providing another accessible, understandable 2FA option that developers can enable.

Nope, useless initiative if they allow people to use SMS codes. Sim-hijacking is so easy that I'd wager not having any 2FA is more secure than offering SMS 2FA, as people will also be able to social engineer Microsoft to give access to a GitHub account if they are the "telephone number owner", as long as they can prove they can solve the SMS 2FA.

Sad to see, but not surprising.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#27

Post by nekonek » Thu, Mar 09, 2023, 5:34 PM UTC

hank_z wrote: post #6

A quick off topic question related to 2FA. If an employee is required to complete the 2FA to access to the company's system, is the company responsible to provide the employee a necessary device (either phone or hardware token) to complete the 2FA?

We actually wanted to give company phones to the staff for this purpose among others but there was a rather big pushback, people didn't wanted another devices to carry.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#28

Post by lapcat » Thu, Mar 09, 2023, 5:34 PM UTC

I despise 2FA with a passion. Such a PITA. I already use separate, unique, long, random passwords for every site. And I don't even keep them on my phone, just on my desktop.

Maybe I should just self-host my few little open source projects...

Re: Raising the bar for software security: GitHub 2FA begins March 13

#29

Post by capableweb » Thu, Mar 09, 2023, 5:35 PM UTC

bob1029 wrote: post #17

hank_z wrote: post #6

A quick off topic question related to 2FA. If an employee is required to complete the 2FA to access to the company's system, is the company responsible to provide the employee a necessary device (either phone or hardware token) to complete the 2FA?

We are factoring this into our "should we buy company iPhones for all employees?" conversation right now.

There are much better alternatives than buying a smartphone if all you want to provide is a 2FA device. Yubikey is one alternative, as a consumer you can buy it for ~50 EUR but I'm sure if you buy 100+ for employees, you can get some sort of deal with them.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#30

Post by kccqzy » Thu, Mar 09, 2023, 5:35 PM UTC

yakkityyak wrote: post #13

GitHub is also one of the few big sites that support Passkeys for 2FA. You can use your Trusted Platform Module, Yubikey, or any Secure Enclave equipped Mac to 2FA.

I also learned that it's possible to create an ECDSA key pair within the Secure Enclave, and it is only possible to extract the public key, or to authenticate with it, including when you SSH to GitHub. Your private key is never on disk.