Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Raising the bar for software security: GitHub 2FA begins March 13

github.blog

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Raising the bar for software security: GitHub 2FA begins March 13

#81

Post by FlxMgdnz »

yakkityyak wrote: post #13

GitHub is also one of the few big sites that support Passkeys for 2FA. You can use your Trusted Platform Module, Yubikey, or any Secure Enclave equipped Mac to 2FA.

Not quite.

Passkeys are WebAuthn "discoverable credentials", meaning they contain a user identifier as well as a private key for signing.

When a site fully supports passkeys, you are able to sign in to your account without having to enter a username, just by using your site-specific passkey (e.g. https://www.passkeys.io).

GitHub's current implementation is based on pre-passkey WebAuthn that allows you to add a non-discoverable credential as 2nd factor. To sign in, you still need to enter your username, your password, and then get prompted for your WebAuthn credential, which can be stored on a physical security key, but also on your devices via the platform authenticator capability (Windows Hello, Touch ID, ...).

So, while GitHub's current 2nd-factor WebAuthn implementation (as awesome as it is) is not "passkey", I'm sure they will be among the first bigger websites to launch full passkey capabilities on their login page pretty soon.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#82

Post by singlow »

HeckFeck wrote: post #56
singlow wrote: post #41

Earlier quoted context omitted.

If you are admin of a Google domain then you can disable SMS for 2fa and require either a hardware key or TOTP.

I wasn't aware that was configurable (we were told SMS or Gauthenticator app), I wanted just a OTP code. I'd be delighted if that's really available. I'll chase it up with our admin. Thanks

Often many 2-factor setup screens will directly reference GAuthenticator, but it is just a TOTP app so you can use any TOTP app with a GAuthenticator qr code, and you can usually get the secret text for copy paste to a desktop TOTP in case you can't scan a qr code, but i have seen some apps that don't make that easy. There is desktop software that will read qr codes from the screen.

In Google's Workspace Admin just got to:

Security -> Authentication -> 2-step verification

Then choose "Any except verification codes via text, phone call". This allows them to use TOTP, a security key such as a usb key or if they have a phone like a Pixel or iPhone that has a security key built in, or TOTP. They can also approve logins from another device that is already logged in, and can generate long-lived backup codes.

You can also allow only a security key, no TOTP or prompts and if, you do that, you can disable backup codes as well.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#83

Post by lsferreira42 »

lapcat wrote: post #28

I despise 2FA with a passion. Such a PITA. I already use separate, unique, long, random passwords for every site. And I don't even keep them on my phone, just on my desktop. Maybe I should just self-host my few little open source projects...

Maybe you should host it yourself, this is not for the hardcore average HN user, it's for the public, the students that still use weak passwords ( sometimes the same on many websites ), people still trying to learn things, if this makes 90% of the accounts secure then it's a success !

Re: Raising the bar for software security: GitHub 2FA begins March 13

#84

Post by lapcat »

lsferreira42 wrote: post #83
lapcat wrote: post #28

I despise 2FA with a passion. Such a PITA. I already use separate, unique, long, random passwords for every site. And I don't even keep them on my phone, just on my desktop. Maybe I should just self-host my few little open source projects...

Maybe you should host it yourself, this is not for the hardcore average HN user, it's for the public, the students that still use weak passwords ( sometimes the same on many websites ), people still trying to learn things, if this makes 90% of the accounts secure then it's a success !

No, that's not it at all. Github's blog post is clear that it only applies to developers "who contribute code", and the point of this is "securing the supply chain".

So yes, this is for the hardcore user and not for the students and people still trying to learn things. The latter are not part of the supply chain.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#85

Post by lsferreira42 »

lapcat wrote: post #84
lsferreira42 wrote: post #83

Earlier quoted context omitted.

Maybe you should host it yourself, this is not for the hardcore average HN user, it's for the public, the students that still use weak passwords ( sometimes the same on many websites ), people still trying to learn things, if this makes 90% of the accounts secure then it's a success !

No, that's not it at all. Github's blog post is clear that it only applies to developers "who contribute code", and the point of this is "securing the supply chain". So yes, this is for the hardcore user and not for the students and people still trying to learn things. The latter are not part of the supply chain.

"developers who contribute code" is anyone who push's things right? So basically every github user

Re: Raising the bar for software security: GitHub 2FA begins March 13

#86

Post by 1over137 »

bee_rider wrote: post #40

Hmm. Is this good? It seems like centralizing the idea of a “GitHub account” as a sort thing that needs to be secured and imbues a commit with trustworthiness. But wouldn’t it make more sense to use the already existing functionality to sign commits, with keys you control, if this is a real concern? Prefer built in git functionality over GitHub-isms, right?

>Prefer built in git functionality over GitHub-isms, right?

This is Microsoft. Embrace (git) and extend (gittub-isms).

Re: Raising the bar for software security: GitHub 2FA begins March 13

#89

Post by lakomen »

BozeWolf wrote: post #18
edflsafoiewq wrote: post #9

I don't want my phone in any way involved in login. Can I still use Github?

Yes. With totp. For example with the bitwarden browser plugin: https://bitwarden.com/help/authenticator-keys/

Bitwarden costs money, doesn't it?

Re: Raising the bar for software security: GitHub 2FA begins March 13

#90

Post by BozeWolf »

lakomen wrote: post #89
BozeWolf wrote: post #18

Earlier quoted context omitted.

Yes. With totp. For example with the bitwarden browser plugin: https://bitwarden.com/help/authenticator-keys/

Bitwarden costs money, doesn't it?

There is a subscription, their free tier is everything you need. I pay them a few (10?) euros a year, because their product is good.
Post reply on HN