Another quick off topic question related to 2FA. If students are required to complete the 2FA to access to university's learning resources, is the university responsible to provide a hardware token if some students cannot afford/use the mobile phone to complete the 2FA?
Raising the bar for software security: GitHub 2FA begins March 13
71–80 of 90 posts
Re: Raising the bar for software security: GitHub 2FA begins March 13
#72Earlier quoted context omitted.
If you already have unique, long, random passwords, I'm guessing you're using a password manager? Why not use the password manager for the 2FA as well? Obviously, if your password manager gets broken into, you're fucked. But if the site only have the issue of exposing passwords, you'll be safe.
> I'm guessing you're using a password manager? Why not use the password manager for the 2FA as well? Mostly the built-in Mac keychain, stored locally, no iCloud.
are you backing up your keychain? or are you okay with losing all passwords if your computer faults.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#73Earlier quoted context omitted.
It looks like it's for accounts that contribute code. Compromised accounts can sneak malicious stuff into dependencies.
Maybe I don't understand what "contribute code" means... Do I only "contribute code" if I open a PR on a repo I don't own? Seems like a good option to allow people to enable, but forcing it is an unnecessary overreach.
I interpret it as: your account publishes code bits in any capacity, as opposed to a read-only account that only pulls and participates in social discussions.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#74Earlier quoted context omitted.
> I'm guessing you're using a password manager? Why not use the password manager for the 2FA as well? Mostly the built-in Mac keychain, stored locally, no iCloud.
are you backing up your keychain? or are you okay with losing all passwords if your computer faults.
> are you backing up your keychain?
Of course. I have encrypted offsite backups, as one should. Doesn't everyone?
Re: Raising the bar for software security: GitHub 2FA begins March 13
#75Why not require all contributors to also verify/sign their commits then?
Re: Raising the bar for software security: GitHub 2FA begins March 13
#76I despise 2FA with a passion. Such a PITA. I already use separate, unique, long, random passwords for every site. And I don't even keep them on my phone, just on my desktop. Maybe I should just self-host my few little open source projects...
This seems a lot like a Microsoft-ism. It's being thrust down your throat and continually seems to be part of an effort to make their lives easier at our inconvenience.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#77The code I upload to github is not part of "the software supply chain". Adding 2fa makes it more likely that I will lose access to my account. There is no way I'm going to participate in this. I'm especially not giving github my phone number or in any way associating my mobile device with their website.
It's pretty easy to add 2FA with almost no detectable increase in the risk of losing one's account.
Pick TOTP as your 2FA method and save the TOTP secret, which you can get on the TOTP setup page at Github by clicking the thing that says you want to use a text code instead of scanning a QR code.
It will give you a short text string. Save that string.
When you need the TOTP code for Github, use oathtool [1] or something similar. For oathtool:
oathtool --totp -b
Re: Raising the bar for software security: GitHub 2FA begins March 13
#78Has there ever been a case where malicious code was contributed from hacked account?
Re: Raising the bar for software security: GitHub 2FA begins March 13
#79The code I upload to github is not part of "the software supply chain". Adding 2fa makes it more likely that I will lose access to my account. There is no way I'm going to participate in this. I'm especially not giving github my phone number or in any way associating my mobile device with their website.
It's pretty easy to add 2FA with almost no detectable increase in the risk of losing one's account. Pick TOTP as your 2FA method and save the TOTP secret, which you can get on the TOTP setup page at Github by clicking the thing that says you want to use a text code instead of scanning a QR code. It will give you a short text string. Save that string. When you need the TOTP code for Github, use oathtool [1] or somethi…
Thank you. I was wrong, and I'm grateful for you taking the time to show me something.
Re: Raising the bar for software security: GitHub 2FA begins March 13
#80Earlier quoted context omitted.
And they still encourage you to have one account shared between multiple jobs/clients.
Do they? Last time I read through the T&C, they say you're not allowed to have multiple free accounts, but if you're paying for it, you should be fine. And if your employer requires you to have a GitHub account, they should pay for one for you to use.
Not exactly inviting, but yes, they do allow it and that counts for something.