41–50 of 90 posts
Earlier quoted context omitted.
You are not required to use your phone number for 2FA. In fact, they discourage users from using SMS for 2FA.
I wish the makers of Google Suite thought the same way.
Earlier quoted context omitted.
We are factoring this into our "should we buy company iPhones for all employees?" conversation right now.
There are much better alternatives than buying a smartphone if all you want to provide is a 2FA device. Yubikey is one alternative, as a consumer you can buy it for ~50 EUR but I'm sure if you buy 100+ for employees, you can get some sort of deal with them.
If we decide to go with a BYOD or other telephony option, then I'm going to push for standardized 2FA hardware devices.
The code I upload to github is not part of "the software supply chain". Adding 2fa makes it more likely that I will lose access to my account. There is no way I'm going to participate in this. I'm especially not giving github my phone number or in any way associating my mobile device with their website.
There are numerous devices you can use for TOTP 2FA, your computer, a hardware device and even your browser via authn.
Earlier quoted context omitted.
In what way? Morally and ethically, I think you're going to get a resounding yes from people here. Legally, I very much doubt it, but I am not a lawyer.
Legally. In my opinion, if something is required for a worker to finish the job, the employer is obligated to provide it for free. I could be wrong. Curious to know other people's thought.
Hmm. Is this good? It seems like centralizing the idea of a “GitHub account” as a sort thing that needs to be secured and imbues a commit with trustworthiness. But wouldn’t it make more sense to use the already existing functionality to sign commits, with keys you control, if this is a real concern? Prefer built in git functionality over GitHub-isms, right?
GitHub is also one of the few big sites that support Passkeys for 2FA. You can use your Trusted Platform Module, Yubikey, or any Secure Enclave equipped Mac to 2FA.
> GitHub is also one of the few big sites that support Passkeys for 2FA. Not yet, it seems? "Lastly, we’re already testing passkeys internally, which we believe will combine ease of use with strong, phishing-resistant authentication. Keep an eye on this space for when this functionality is ready for you."
A quick off topic question related to 2FA. If an employee is required to complete the 2FA to access to the company's system, is the company responsible to provide the employee a necessary device (either phone or hardware token) to complete the 2FA?
We are factoring this into our "should we buy company iPhones for all employees?" conversation right now.
I despise 2FA with a passion. Such a PITA. I already use separate, unique, long, random passwords for every site. And I don't even keep them on my phone, just on my desktop. Maybe I should just self-host my few little open source projects...
I despise 2FA with a passion. Such a PITA. I already use separate, unique, long, random passwords for every site. And I don't even keep them on my phone, just on my desktop. Maybe I should just self-host my few little open source projects...
If you already have unique, long, random passwords, I'm guessing you're using a password manager? Why not use the password manager for the 2FA as well? Obviously, if your password manager gets broken into, you're fucked. But if the site only have the issue of exposing passwords, you'll be safe.
Why suggest an extra step to them if they're claiming it's unnecessary? Can you at least try to explain why you think it adds value?
Hmm. Is this good? It seems like centralizing the idea of a “GitHub account” as a sort thing that needs to be secured and imbues a commit with trustworthiness. But wouldn’t it make more sense to use the already existing functionality to sign commits, with keys you control, if this is a real concern? Prefer built in git functionality over GitHub-isms, right?
And they still encourage you to have one account shared between multiple jobs/clients.
Last time I read through the T&C, they say you're not allowed to have multiple free accounts, but if you're paying for it, you should be fine. And if your employer requires you to have a GitHub account, they should pay for one for you to use.