From a cursory read the options for 2FA are: - SMS - Mobile app What if someone doesn't have a phone?
Any TOTP app will work, but most people will use an app on their phone. Plenty of desktop apps exist. There are also usb key devices supported.
Raising the bar for software security: GitHub 2FA begins March 13
31–40 of 90 posts
Re: Raising the bar for software security: GitHub 2FA begins March 13
#32A quick off topic question related to 2FA. If an employee is required to complete the 2FA to access to the company's system, is the company responsible to provide the employee a necessary device (either phone or hardware token) to complete the 2FA?
Absolutely yes.
Hardware tokens cost <$50, compared to what companies pay employees on a monthly basis it's peanuts.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#33GitHub is also one of the few big sites that support Passkeys for 2FA. You can use your Trusted Platform Module, Yubikey, or any Secure Enclave equipped Mac to 2FA.
> GitHub is also one of the few big sites that support Passkeys for 2FA.
Not yet, it seems? "Lastly, we’re already testing passkeys internally, which we believe will combine ease of use with strong, phishing-resistant authentication. Keep an eye on this space for when this functionality is ready for you."
Re: Raising the bar for software security: GitHub 2FA begins March 13
#34I despise 2FA with a passion. Such a PITA. I already use separate, unique, long, random passwords for every site. And I don't even keep them on my phone, just on my desktop. Maybe I should just self-host my few little open source projects...
If you already have unique, long, random passwords, I'm guessing you're using a password manager? Why not use the password manager for the 2FA as well?
Obviously, if your password manager gets broken into, you're fucked. But if the site only have the issue of exposing passwords, you'll be safe.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#35This is a step in the right direction. Although if i’m not mistaken the case for somebody stealing your .ssh directory with keys and contributing to GitHub over SSH still stands. I guess it’d be hard to require everybody to password protect their ssh keys.
The vast majority of attacks these days are not via compromised desktop environments. They are from phishing, password reuse + third party password compromises, and weak passwords.
Its these most common attacks that Github is addressing with this change.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#36The code I upload to github is not part of "the software supply chain". Adding 2fa makes it more likely that I will lose access to my account. There is no way I'm going to participate in this. I'm especially not giving github my phone number or in any way associating my mobile device with their website.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#37Raising the bar for security theater.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#38A quick off topic question related to 2FA. If an employee is required to complete the 2FA to access to the company's system, is the company responsible to provide the employee a necessary device (either phone or hardware token) to complete the 2FA?
If the company provides employees with a key to access the office, are they obliged to provide the employee with a keyring on which to put it? A pocket to keep it in? Or are they able to assume that the employee probably would prefer to keep the key on their own keyring, in their own pocket?
I feel the same about 2FA tokens. As a matter of convenience I install the tokens my employer gives me on my personal phone because it makes it easy for me to keep them available at all times.
If for some reason I was unable or unwilling to do so, though, I might expect to be allowed to expense a yubikey.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#39This is just shenanigans to get our phone numbers. As if forcing keys over password was not bad enough. I wonder if I will be able to connect and pull from a private repository without 2FA. Otherwise my personal web server setup breaks.
You are not required to use your phone number for 2FA. In fact, they discourage users from using SMS for 2FA.
> In fact, they discourage users from using SMS for 2FA.
Obviously, but I don't think they did good enough. Why enable SMS 2FA at all? It's horribly insecure.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#40Hmm. Is this good?
It seems like centralizing the idea of a “GitHub account” as a sort thing that needs to be secured and imbues a commit with trustworthiness. But wouldn’t it make more sense to use the already existing functionality to sign commits, with keys you control, if this is a real concern?
Prefer built in git functionality over GitHub-isms, right?