I like the idea of adding second-factor authentication to your Git credentials. But doing this using OAuth to a cloud service just seems like the wrong approach

I like the idea of adding second-factor authentication to your Git credentials. But doing this using OAuth to a cloud service just seems like the wrong approach. Use SSH keys, and then either (a) set a good password on your key, or (b) store the key on a hardware token, like a Yubikey. [1] I think the big problem here is that they're using HTTP(S) as a transport for Git. And there's just not very many options left for layering on extra security if you do that. [1]: I'm a big fan of Yubikeys for credential storage. You can put them in PGP Smartcard mode, and then use the PGP key with SSH: https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubikey-neo/ https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubike...