Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub supports Universal 2nd Factor authentication

github.com

Post reply on HN
Print view View original

11–20 of 85 posts

Re: GitHub supports Universal 2nd Factor authentication

#11

Post by fak3r »

jasoncartwright wrote: post #3
dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

I've used a YubiKey for 2FA for a year or so now. It just sits in my USB port and it feels too convenient - steal my laptop and you get my key. At least my phone has a PIN.

Mine is on my keychain, plus you need my username, password and yubikey to authenticate, so if someone steals my laptop (oh noes!) they still have hurdles to jump.

Re: GitHub supports Universal 2nd Factor authentication

#14

Post by j_s »

If you want to try for one of the 5,000 $5 Yubikey with everyone else currently killing the server...

1) sign in with github at: https://www.yubico.com/github-special-offer/

2) buy now: https://www.yubico.com/github-special-offer/github-yubikey-s...

3) checkout: https://www.yubico.com/checkout/

Once you complete one step successfully you should be able to skip to the next. Good luck vs. the 504's!

Re: GitHub supports Universal 2nd Factor authentication

#15

Post by philip1209 »

I like this because I keep a U2F Neo-n device permanently in my laptop USB port. It's just more convenient for services that support it. In the future, I would like to require it for employees on our app.

However, when I go into Github to turn it on (in chrome using U2F devices I have already used with Google) it says "This device cannot be registered." Even when I remove the device it says that. I'm disappointed that the feature is not working.

Re: GitHub supports Universal 2nd Factor authentication

#16

Post by sandstrom »

jasoncartwright wrote: post #3
dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

I've used a YubiKey for 2FA for a year or so now. It just sits in my USB port and it feels too convenient - steal my laptop and you get my key. At least my phone has a PIN.

I think the (relatively) small overlap between knowing your password and stealing your computer is important here.

Passwords are weak vs. many types of hacks, U2F is strong. And vice-versa (easy to steal the Yubi-key + computer, but they still need the password).

Re: GitHub supports Universal 2nd Factor authentication

#17

Post by striking »

j_s wrote: post #14

If you want to try for one of the 5,000 $5 Yubikey with everyone else currently killing the server... 1) sign in with github at: https://www.yubico.com/github-special-offer/ 2) buy now: https://www.yubico.com/github-special-offer/github-yubikey-s... 3) checkout: https://www.yubico.com/checkout/ Once you complete one step successfully you should be able to skip to the next. Good luck vs. the 504's!

Thank you very much, the individual links are great.

Re: GitHub supports Universal 2nd Factor authentication

#18

Post by sowbug »

chedabob wrote: post #8

I can't think of a single compelling reason to use this over Google Authenticator.

It's faster. No typing. No worry about malware stealing your OTP secret. It's easy to revoke a single device if you lose it without having to change your Authenticator secrets everywhere. And it looks cool.

Re: GitHub supports Universal 2nd Factor authentication

#19

Post by dheera »

I never understood the point of 2-factor authentication, and moreover, certain agencies (e.g. banks) that force using it. Can't we just pick good enough passwords?

Personally I hate being {attached to|associated with|being required to carry} a particular piece of hardware; I much prefer that information freely flows with me as I move between the various devices I interact with over the course of a day.

There are many times I don't carry my phone around with me or do not wish to, simply because I have a terminal that loads my personalized environment everywhere I go. Information flows with me, not hardware.

Re: GitHub supports Universal 2nd Factor authentication

#20

Post by lfowles »

j_s wrote: post #14

If you want to try for one of the 5,000 $5 Yubikey with everyone else currently killing the server... 1) sign in with github at: https://www.yubico.com/github-special-offer/ 2) buy now: https://www.yubico.com/github-special-offer/github-yubikey-s... 3) checkout: https://www.yubico.com/checkout/ Once you complete one step successfully you should be able to skip to the next. Good luck vs. the 504's!

EDIT: Disregard, they're still available. Discount is applied to the subtotal, not individual items.

Original Post: Looks like the $5 keys are sold out, my cart shows $36

Post reply on HN