3 ms·
> To use 2fa on github you need a mobile phone. This is incorrect. You only need the ability to generate TOTP or U2F tokens. This is often done using a smartp
by rgrove 9y ago
> To use 2fa on github you need a mobile phone.
This is incorrect.
You only need the ability to generate TOTP or U2F tokens. This is often done using a smartphone app, but can also be done by a desktop app like 1Password or a hardware device like a Yubikey:
https://github.com/blog/2071-github-supports-universal-2nd-factor-authentication https://github.com/blog/2071-github-supports-universal-2nd-f...
- thaumasiotes 9y agoYou can also record the TOTP secret in your automated login script, next to your password, and generate the token on the fly right there. It's things like that that make me wonder why TOTP tokens are supposed to be conceptually different from passwords. A TOTP scheme involves knowing a master password, and nothing else.
- Xylakant 9y agoRecording a TOTP secret next to your password would make 2FA worthless, true. That’s why you should use hardware generators whenever possible. However, Github supports Fido/u2f which is conceptually superior to TOTP: The authentication secret is bound to the domain and the token generator verifies this. So even a software u2f implementation protects against phishing for example, while TOTP does not.
- bringtheaction 9y agoDo you know of any open source software implementations of u2f.
- Xylakant 9y agoFirefox includes one IIRC and there’s githubs SoftU2F for Mac https://github.com/github/SoftU2F https://github.com/github/SoftU2F