"Note: FIDO U2F authentication is currently only available for the Chrome browser." https://help.github.com/articles/providing-your-2fa-authenti...
Here's the issue for the feature in Firefox
https://bugzilla.mozilla.org/show_bug.cgi?id=1065729
GitHub supports Universal 2nd Factor authentication
21–30 of 85 posts
Re: GitHub supports Universal 2nd Factor authentication
#22If you want to try for one of the 5,000 $5 Yubikey with everyone else currently killing the server... 1) sign in with github at: https://www.yubico.com/github-special-offer/ 2) buy now: https://www.yubico.com/github-special-offer/github-yubikey-s... 3) checkout: https://www.yubico.com/checkout/ Once you complete one step successfully you should be able to skip to the next. Good luck vs. the 504's!
EDIT: Disregard, they're still available. Discount is applied to the subtotal, not individual items. Original Post: Looks like the $5 keys are sold out, my cart shows $36
A discount is applied at checkout.
Re: GitHub supports Universal 2nd Factor authentication
#23I never understood the point of 2-factor authentication, and moreover, certain agencies (e.g. banks) that force using it. Can't we just pick good enough passwords? Personally I hate being {attached to|associated with|being required to carry} a particular piece of hardware; I much prefer that information freely flows with me as I move between the various devices I interact with over the course of a day. There are many…
[deleted]
Re: GitHub supports Universal 2nd Factor authentication
#24If you want to try for one of the 5,000 $5 Yubikey with everyone else currently killing the server... 1) sign in with github at: https://www.yubico.com/github-special-offer/ 2) buy now: https://www.yubico.com/github-special-offer/github-yubikey-s... 3) checkout: https://www.yubico.com/checkout/ Once you complete one step successfully you should be able to skip to the next. Good luck vs. the 504's!
The only international shipping option I can see is DHL Express for $65.00 :(
Re: GitHub supports Universal 2nd Factor authentication
#25Good to see that. Hope more services will support it also soon.
Re: GitHub supports Universal 2nd Factor authentication
#26I never understood the point of 2-factor authentication, and moreover, certain agencies (e.g. banks) that force using it. Can't we just pick good enough passwords? Personally I hate being {attached to|associated with|being required to carry} a particular piece of hardware; I much prefer that information freely flows with me as I move between the various devices I interact with over the course of a day. There are many…
You're expressing a preference for convenience over security. The truth is that most people pick bad passwords, and even good passwords can be cracked.
2FA with a physical component is generally the best way to achieve the goal of "information flows with me". With a password only, you can more aptly describe the situation as "information flows with anyone who knows my password".
Re: GitHub supports Universal 2nd Factor authentication
#27This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?
One thing to consider is the possibility of your phone itself being compromised (stagefright et al.). Note how Duo issued a security advisory to limit access for Android devices [1].
A fully isolated component like a Yubikey has a smaller attack surface area for these kinds of things (easier to audit smaller code, no sustained Internet or cellular connectivity).
[1]https://www.duosecurity.com/blog/understanding-your-exposure...
Re: GitHub supports Universal 2nd Factor authentication
#28This is fun:
Notice: load_plugin_textdomain was called with an argument that is deprecated since version 2.7 with no alternative available. in /nas/wp/www/cluster-50027/yubico2/wp-includes/functions.php on line 3510
Notice: Use of undefined constant WOOCOMMERCE_VERSION - assumed 'WOOCOMMERCE_VERSION' in /nas/wp/www/cluster-50027/yubico2/wp-content/plugins/woocommerce-wootax/woocommerce-wootax.php on line 552
Fatal error: Class 'WC_Payment_Gateway' not found in /nas/wp/www/cluster-50027/yubico2/wp-content/plugins/yubico-payment/yubico-payment.php on line 16Re: GitHub supports Universal 2nd Factor authentication
#29I never understood the point of 2-factor authentication, and moreover, certain agencies (e.g. banks) that force using it. Can't we just pick good enough passwords? Personally I hate being {attached to|associated with|being required to carry} a particular piece of hardware; I much prefer that information freely flows with me as I move between the various devices I interact with over the course of a day. There are many…
You're expressing a preference for convenience over security. The truth is that most people pick bad passwords, and even good passwords can be cracked. 2FA with a physical component is generally the best way to achieve the goal of "information flows with me". With a password only, you can more aptly describe the situation as "information flows with anyone who knows my password".
In that case, can we do 2FA with something biometric? Or even 2 passwords?
A physical component has a lot of issues:
* It can be stolen or robbed at gunpoint. Torture, drugging, and hypnosis aside, your mind is much more secure.
* It can run out of batteries.
* It's one more thing you can lose. It's already annoying enough to have to remember to carry 7 or 8 things every day, including a phone, bike light, smart watch, tablet, battery pack, reusable utensils, and so on. I don't want to have to add more things to this list.
* It can be damaged by the elements.
* It can be difficult to give access to others who you want to give access to.
* It may have security holes of its own, both in hardware and in software.
* When damaged or robbed, the user is highly inconvenienced, to the point that they are unable to access their own money/accounts/etc. How do get food, water, and get home from the middle of nowhere after your wallet and phone have been taken from your person? With password-only methods, you could theoretically find a nearby public terminal, log in with a simple username and password, and get an ride/call a friend/file a report/do whatever you need to do.
* If it relies on cellular service, it may not work internationally if the user changes SIM cards or devices. For many that live near border towns and cross borders every day for work, this becomes a massive inconvenience.
Re: GitHub supports Universal 2nd Factor authentication
#30Earlier quoted context omitted.
You're expressing a preference for convenience over security. The truth is that most people pick bad passwords, and even good passwords can be cracked. 2FA with a physical component is generally the best way to achieve the goal of "information flows with me". With a password only, you can more aptly describe the situation as "information flows with anyone who knows my password".
In that case, can we do 2FA with something biometric? Or even 2 passwords? A physical component has a lot of issues: * It can be stolen or robbed at gunpoint. Torture, drugging, and hypnosis aside, your mind is much more secure. * It can run out of batteries. * It's one more thing you can lose. It's already annoying enough to have to remember to carry 7 or 8 things every day, including a phone, bike light, smart watc…
Biometrics make great usernames but poor passwords since they can't be changed. Imagine a fingerprint system of some kind - someone images your fingerprint from, say, a leftover coffee cup (not hard or expensive to do), and you're pwned.