3 ms·

Hm, but you have an Authenticator App enabled. If I "Edit" my SMS Number, I get to choose whether I want to proceed with "Set up using app" or "Set up using SMS

Hm, but you have an Authenticator App enabled. If I "Edit" my SMS Number, I get to choose whether I want to proceed with "Set up using app" or "Set up using SMS", but not "Set up using security key". The point of having two keys is that there is no need for neither an authenticator app nor SMS.

akerl_ 7y ago
It would rock to be able to avoid having the Authenticator app, but I think “U2F plus a TOTP device” is pretty solidly better than “U2F plus SMS”, and this comment tree is suggesting that GitHub doesn’t allow for disabling SMS. If you do U2F with 2 keys, TOTP, and throw away the TOTP secret after you activate it, you’re exposed to a slight additional risk because the TOTP secret is still stored by Github, but that’s radically better than a world where they mandate SMS.
- archi42 7y ago
  True, I just amended my initial comment to reflect the fact that GitHub is not as bad as I made it look like, but the second class citizen point still stands, even if some workaround like "throw away the TOTP" is applied.
  - akerl_ 7y ago
    I agree with your overall point. I’m hopeful that bringing U2F/FIDO2 to iPhone will help continue to push these standards into being first-class citizens. Right now, I use TOTP for a ton of sites because I’m using an iPad Pro as my primary workstation, despite the fact that it has a USB-C port and I’ve got a pile of USB-C Yubikeys.
jwr 7y ago
> The point of having two keys is that there is no need for neither an authenticator app nor SMS I think they are striking a reasonable compromise. I am OK with using U2F and having TOTP authenticator as a backup plan. I am definitely NOT OK with requiring SMS for authentication, though, which is unfortunately the direction all the corporate sheep seem to be taking (namely, banks).

3 ms·

Hm, but you have an Authenticator App enabled. If I "Edit" my SMS Number, I get to choose whether I want to proceed with "Set up using app" or "Set up using SMS

by archi42 7y ago

akerl_ 7y ago
It would rock to be able to avoid having the Authenticator app, but I think “U2F plus a TOTP device” is pretty solidly better than “U2F plus SMS”, and this comment tree is suggesting that GitHub doesn’t allow for disabling SMS. If you do U2F with 2 keys, TOTP, and throw away the TOTP secret after you activate it, you’re exposed to a slight additional risk because the TOTP secret is still stored by Github, but that’s radically better than a world where they mandate SMS.
- archi42 7y ago
  True, I just amended my initial comment to reflect the fact that GitHub is not as bad as I made it look like, but the second class citizen point still stands, even if some workaround like "throw away the TOTP" is applied.
  - akerl_ 7y ago
    I agree with your overall point. I’m hopeful that bringing U2F/FIDO2 to iPhone will help continue to push these standards into being first-class citizens. Right now, I use TOTP for a ton of sites because I’m using an iPad Pro as my primary workstation, despite the fact that it has a USB-C port and I’ve got a pile of USB-C Yubikeys.
jwr 7y ago
> The point of having two keys is that there is no need for neither an authenticator app nor SMS I think they are striking a reasonable compromise. I am OK with using U2F and having TOTP authenticator as a backup plan. I am definitely NOT OK with requiring SMS for authentication, though, which is unfortunately the direction all the corporate sheep seem to be taking (namely, banks).