51–60 of 90 posts
Earlier quoted context omitted.
In what way? Morally and ethically, I think you're going to get a resounding yes from people here. Legally, I very much doubt it, but I am not a lawyer.
Legally. In my opinion, if something is required for a worker to finish the job, the employer is obligated to provide it for free. I could be wrong. Curious to know other people's thought.
See the entire food delivery industry
Absolutely insane. Why does Github even care whether I use 2FA?
It looks like it's for accounts that contribute code. Compromised accounts can sneak malicious stuff into dependencies.
Earlier quoted context omitted.
In what way? Morally and ethically, I think you're going to get a resounding yes from people here. Legally, I very much doubt it, but I am not a lawyer.
Legally. In my opinion, if something is required for a worker to finish the job, the employer is obligated to provide it for free. I could be wrong. Curious to know other people's thought.
Or “I don’t bring it to work, I want to focus on your issues 100% no distractions, boss :)”
Earlier quoted context omitted.
If you already have unique, long, random passwords, I'm guessing you're using a password manager? Why not use the password manager for the 2FA as well? Obviously, if your password manager gets broken into, you're fucked. But if the site only have the issue of exposing passwords, you'll be safe.
> Why not use the password manager for the 2FA as well? Why suggest an extra step to them if they're claiming it's unnecessary? Can you at least try to explain why you think it adds value?
I thought I already did? "But if the site only have the issue of exposing passwords, you'll be safe." is not clear enough?
The code I upload to github is not part of "the software supply chain". Adding 2fa makes it more likely that I will lose access to my account. There is no way I'm going to participate in this. I'm especially not giving github my phone number or in any way associating my mobile device with their website.
2FA != associating your mobile device. There are numerous devices you can use for TOTP 2FA, your computer, a hardware device and even your browser via authn.
Earlier quoted context omitted.
I wish the makers of Google Suite thought the same way.
If you are admin of a Google domain then you can disable SMS for 2fa and require either a hardware key or TOTP.
I can lose my authenticator app, printed backup code, my hardware key but I'd still have a way to get access to my account back.
Infact I was on the "sms is unsafe" bandwagon until I nearly lost access to my Google Account.
Never again. Sim jacking is not a real world issue for most people. I'm not special enough that someone, especially someone who has the means to do sim jacking to want access to my accounts.
People do what you are comfortable with, if you are that important, I'm sure whoever wants your stuff will find other ways to get it.[1]
GitHub is also one of the few big sites that support Passkeys for 2FA. You can use your Trusted Platform Module, Yubikey, or any Secure Enclave equipped Mac to 2FA.
> GitHub is also one of the few big sites that support Passkeys for 2FA. Not yet, it seems? "Lastly, we’re already testing passkeys internally, which we believe will combine ease of use with strong, phishing-resistant authentication. Keep an eye on this space for when this functionality is ready for you."
I despise 2FA with a passion. Such a PITA. I already use separate, unique, long, random passwords for every site. And I don't even keep them on my phone, just on my desktop. Maybe I should just self-host my few little open source projects...
If you already have unique, long, random passwords, I'm guessing you're using a password manager? Why not use the password manager for the 2FA as well? Obviously, if your password manager gets broken into, you're fucked. But if the site only have the issue of exposing passwords, you'll be safe.
Mostly the built-in Mac keychain, stored locally, no iCloud.
The only case where it should be fine to have a single second factor is with your employer, where you have other means to authenticate (i.e. likely your boss knows you and can vouch for you on a 2FA reset).
Also making it mandatory for things that you may really don't care about is overkill.
I would prefer to have ID verification, rather than an anonymous account, for account recovery.
You lose the second factor, and you can re-authenticate by, let's say, making a small payment with a credit card in your name plus some photo id.