Tell HN: GitHub forcing 2FA on users has no basis in their ToS

#1

Post by devguy2 » Thu, Mar 23, 2023, 5:55 PM UTC

Recently I received an email from GitHub telling me i need to enable 2FA because i'm a somewhat active (hobbyist!) developer...

But the ToS very clearly states:

"You are responsible for keeping your Account secure while you use our Service. We offer tools such as two-factor authentication to help you maintain your Account's security, but the content of your Account and its security are up to you."

I think it is cute when corporations don't even bother to conform to their ToS themselves. This one is even almost readable.

Anyway, i just thought you'd like to know. Have a nice day!

Re: Tell HN: GitHub forcing 2FA on users has no basis in their ToS

#2

Post by rozenmd » Thu, Mar 23, 2023, 6:39 PM UTC

IANAL, but ToS's provide companies an option, not an obligation, to do something.

It's not a law.

Re: Tell HN: GitHub forcing 2FA on users has no basis in their ToS

#3

Post by jamesboehmer » Thu, Mar 23, 2023, 6:48 PM UTC

Are you against 2fa, or against being compelled to use it? Why?

Re: Tell HN: GitHub forcing 2FA on users has no basis in their ToS

#4

Post by OtmaneBenazzou » Thu, Mar 23, 2023, 6:49 PM UTC

Are you going to cry because a company wants your data to be a bit more safe?

Re: Tell HN: GitHub forcing 2FA on users has no basis in their ToS

#5

Post by tkw01536 » Thu, Mar 23, 2023, 6:53 PM UTC

IANAL but I don’t think that GitHub is violating their ToS here.

L4 says ”GitHub has the right to suspend […] your access […] at any time […]. GitHub reserves the right to refuse service to anyone for any reason at any time.”

Re: Tell HN: GitHub forcing 2FA on users has no basis in their ToS

#6

Post by devguy2 » Thu, Mar 23, 2023, 7:07 PM UTC

jamesboehmer wrote: post #3

Are you against 2fa, or against being compelled to use it? Why?

The latter. And especially the reasoning they provide W.R.T. "securing the software supply chain". I have a strong, managed, password which is perfectly reasonable for a few hobby hacks...

See also: "I am not a supplier" https://news.ycombinator.com/item?id=34201368

Re: Tell HN: GitHub forcing 2FA on users has no basis in their ToS

#7

Post by devguy2 » Thu, Mar 23, 2023, 7:10 PM UTC

tkw01536 wrote: post #5

IANAL but I don’t think that GitHub is violating their ToS here. L4 says ”GitHub has the right to suspend […] your access […] at any time […]. GitHub reserves the right to refuse service to anyone for any reason at any time.”

Sue, "no basis" is perhaps a bit spicy.... but it's still an active contradiction that they could have easily changed. (And in doing so should have made them at least think twice before pushing this).

Re: Tell HN: GitHub forcing 2FA on users has no basis in their ToS

#8

Post by Melingo » Thu, Mar 23, 2023, 7:11 PM UTC

They write the tos.

It doesn't matter if they updated them in time for someone actually reading a tos.

Re: Tell HN: GitHub forcing 2FA on users has no basis in their ToS

#9

Post by ipaddr » Thu, Mar 23, 2023, 7:18 PM UTC

OtmaneBenazzou wrote: post #4

Are you going to cry because a company wants your data to be a bit more safe?

Then you won't objective to 3fa or 20fa. More steps is safer right?

If your account is unimportant to you github shouldn't force you to add layers of security when they literally throw you under the bus in the TOS telling you it is your responsibility.. good let me decide my level of risk.

Re: Tell HN: GitHub forcing 2FA on users has no basis in their ToS

#10

Post by MuffinFlavored » Thu, Mar 23, 2023, 7:18 PM UTC

Not super related but it's funny that Twitter basically shed text 2FA unless you pay for it with their monthly blue checkmark thing, demoting anybody who had text 2FA to authenticator style app to save on cost, whereas Microsoft/GitHub are forcing everybody to enroll, which would inverse what Twitter did and send their 2FA SMS costs through the roof.