4 ms·

-1 to this. while 2FA is a no-brainer for most of us, publicly listing (or showing status) not only encroaches individual liberty to make a choice, it would ope

-1 to this. while 2FA is a no-brainer for most of us, publicly listing (or showing status) not only encroaches individual liberty to make a choice, it would open such users to be targets of an attack. Enforcing 2FA in an organization seems more appropriate. Perhaps npmjs.com has implemented that since last I looked, but I know in the past that enforcement was not available. I also greatly dislike the trend of public "shaming" that's so prevalent today. The internet has made us cruel.

akvadrako 8y ago
Indeed, why would we want to use packages from people who can't be bothered to use 2FA?
koolba 8y ago
> -1 to this. while 2FA is a no-brainer for most of us, publicly listing (or showing status) not only encroaches individual liberty to make a choice, it would open such users to be targets of an attack. Saying that you refuse to enable 2FA is the information security equivalent of saying you refuse to wear a condom. Of course people are free to make their own choices but I personally wouldn't take anyone who publishes software seriously if it's not enabled. This isn't like securing access to a social media or shopping account. The ramifications of a breach can quickly cascade and 2FA is low hanging fruit to stop a lot of that. It's far from perfect but it goes a long way. > Enforcing 2FA in an organization seems more appropriate. Perhaps npmjs.com has implemented that since last I looked, but I know in the past that enforcement was not available. The nested nature of dependencies makes partial enforcement pointless: A (2FA) > B (2FA) > C (2FA) > D (no 2FA!) > I also greatly dislike the trend of public "shaming" that's so prevalent today. The internet has made us cruel. I wholeheartedly agree with you on both points and, outside of security, I can't think of any other example where I'd be open to it. I like to think I hold myself and people in our own industry to higher standards than the Internet at large.
Kalium 8y ago
I, too, greatly dislike the cruelty of public shaming. It's inhumane, and dehumanizes us all. Recently I was tasked with improving 2FA usage in my company's GitHub organization. My first approach was to nicely, neatly, and personably ask people, coupled with regular announcements to make sure everyone knew. Every interaction came with documentation on how to do it and a sincere offer to walk them through it. Totally reasonable approach, executed with kindness and compassion. The cynic in me was unsurprised when this rapidly became a Sisyphean task. A number of people, upon faced with being informed in half a dozen different ways, professed to have no idea that they were expected to enable 2FA. Others swore up and down to me that they knew what to do and would shortable enable it, only for it to still be off a week or more later. At this point I decided that kindness and human compassion were a drain on my time and clearly ineffectual. So I grabbed a junior engineer and we wrote a script that automatically removes from the org anyone who doesn't have 2FA enabled. Announced it to everyone, every manager on board, and turned it on. Overnight, the problem went away, and has largely stayed away. Once in a while people publicly ask why they were kicked out and are reminded that they were informed of the 2FA requirement. This isn't an approach characterized by humanity and kindness. It is, however, one that is effective and time-efficient.
- snowwolf 8y ago
  Why did you need to write a script? GitHub allows you to enforce 2FA at the organisation level. https://help.github.com/articles/requiring-two-factor-authentication-in-your-organization/ https://help.github.com/articles/requiring-two-factor-authen...
  - Kalium 8y ago
    You're absolutely right! GitHub does offer that wonderful feature. There are some legacy bot accounts that we cannot readily tradition to 2FA and we cannot do without. The feature you have so rightly pointed to would evict them from the org. That's not an acceptable outcome in this case. I skipped over this in my previous comment because I felt it wasn't germane to the story or the point.

akvadrako 8y ago

Indeed, why would we want to use packages from people who can't be bothered to use 2FA?

koolba 8y ago

> -1 to this. while 2FA is a no-brainer for most of us, publicly listing (or showing status) not only encroaches individual liberty to make a choice, it would open such users to be targets of an attack. Saying that you refuse to enable 2FA is the information security equivalent of saying you refuse to wear a condom. Of course people are free to make their own choices but I personally wouldn't take anyone who publishes software seriously if it's not enabled. This isn't like securing access to a social media or shopping account. The ramifications of a breach can quickly cascade and 2FA is low hanging fruit to stop a lot of that. It's far from perfect but it goes a long way. > Enforcing 2FA in an organization seems more appropriate. Perhaps npmjs.com has implemented that since last I looked, but I know in the past that enforcement was not available. The nested nature of dependencies makes partial enforcement pointless: A (2FA) > B (2FA) > C (2FA) > D (no 2FA!) > I also greatly dislike the trend of public "shaming" that's so prevalent today. The internet has made us cruel. I wholeheartedly agree with you on both points and, outside of security, I can't think of any other example where I'd be open to it. I like to think I hold myself and people in our own industry to higher standards than the Internet at large.

Kalium 8y ago

I, too, greatly dislike the cruelty of public shaming. It's inhumane, and dehumanizes us all. Recently I was tasked with improving 2FA usage in my company's GitHub organization. My first approach was to nicely, neatly, and personably ask people, coupled with regular announcements to make sure everyone knew. Every interaction came with documentation on how to do it and a sincere offer to walk them through it. Totally reasonable approach, executed with kindness and compassion. The cynic in me was unsurprised when this rapidly became a Sisyphean task. A number of people, upon faced with being informed in half a dozen different ways, professed to have no idea that they were expected to enable 2FA. Others swore up and down to me that they knew what to do and would shortable enable it, only for it to still be off a week or more later. At this point I decided that kindness and human compassion were a drain on my time and clearly ineffectual. So I grabbed a junior engineer and we wrote a script that automatically removes from the org anyone who doesn't have 2FA enabled. Announced it to everyone, every manager on board, and turned it on. Overnight, the problem went away, and has largely stayed away. Once in a while people publicly ask why they were kicked out and are reminded that they were informed of the 2FA requirement. This isn't an approach characterized by humanity and kindness. It is, however, one that is effective and time-efficient.

snowwolf 8y ago
Why did you need to write a script? GitHub allows you to enforce 2FA at the organisation level. https://help.github.com/articles/requiring-two-factor-authentication-in-your-organization/ https://help.github.com/articles/requiring-two-factor-authen...
- Kalium 8y ago
  You're absolutely right! GitHub does offer that wonderful feature. There are some legacy bot accounts that we cannot readily tradition to 2FA and we cannot do without. The feature you have so rightly pointed to would evict them from the org. That's not an acceptable outcome in this case. I skipped over this in my previous comment because I felt it wasn't germane to the story or the point.