Raising the bar for software security: GitHub 2FA begins March 13

This is a step in the right direction. Although if i’m not mistaken the case for somebody stealing your .ssh directory with keys and contributing to GitHub over SSH still stands.

I guess it’d be hard to require everybody to password protect their ssh keys.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#5

Post by notlukesky » Thu, Mar 09, 2023, 5:27 PM UTC

[dead]

Re: Raising the bar for software security: GitHub 2FA begins March 13

#6

Post by hank_z » Thu, Mar 09, 2023, 5:27 PM UTC

A quick off topic question related to 2FA. If an employee is required to complete the 2FA to access to the company's system, is the company responsible to provide the employee a necessary device (either phone or hardware token) to complete the 2FA?

Re: Raising the bar for software security: GitHub 2FA begins March 13

#7

Post by 0xffff2 » Thu, Mar 09, 2023, 5:28 PM UTC

hank_z wrote: post #6

A quick off topic question related to 2FA. If an employee is required to complete the 2FA to access to the company's system, is the company responsible to provide the employee a necessary device (either phone or hardware token) to complete the 2FA?

In what way? Morally and ethically, I think you're going to get a resounding yes from people here. Legally, I very much doubt it, but I am not a lawyer.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#8

Post by Avamander » Thu, Mar 09, 2023, 5:29 PM UTC

rightbyte wrote: post #3

This is just shenanigans to get our phone numbers. As if forcing keys over password was not bad enough. I wonder if I will be able to connect and pull from a private repository without 2FA. Otherwise my personal web server setup breaks.

> I wonder if I will be able to connect and pull from a private repository without 2FA.

Per-repository deploy tokens should function for that purpose.

Re: Raising the bar for software security: GitHub 2FA begins March 13

#9

Post by edflsafoiewq » Thu, Mar 09, 2023, 5:29 PM UTC

I don't want my phone in any way involved in login. Can I still use Github?

Re: Raising the bar for software security: GitHub 2FA begins March 13

#10

Post by wiredfool » Thu, Mar 09, 2023, 5:29 PM UTC

rightbyte wrote: post #3

This is just shenanigans to get our phone numbers. As if forcing keys over password was not bad enough. I wonder if I will be able to connect and pull from a private repository without 2FA. Otherwise my personal web server setup breaks.

You can easily use TOTP or webauthn as a second factor.