3 ms·
If github did their 2FA correctly/very securely, it may literally be impossible for them to give you access again. The entire point of 2FA is to avoid someone
by buildbot 7y ago
If github did their 2FA correctly/very securely, it may literally be impossible for them to give you access again.
The entire point of 2FA is to avoid someone taking over your email and then being able to access _anything_ tied to that email.
- soheil 7y ago> If github did their 2FA correctly/very securely, it may literally be impossible for them to give you access again. This is probably the most popular current dogma in security circles. This is a policy issue not an intractable mathematical problem. In theory maybe it could be as rigorous as math but in practice security is always relative.
- jeremyjh 7y agoCan you describe the architecture that would make this possible?
- userbinator 7y agoThe entire point of 2FA is to avoid someone taking over your email and then being able to access _anything_ tied to that email. The same can be said for strong encryption, where losing the keys means you have no chance of recovery. I'm not an advocate of defaulting to things like full-disk-encryption for that reason (and know people who lost a lot due to that.) I guess the underlying problem is "humans are fallible, strong security is not", and that risks "in the other direction" aren't often mentioned; would you rather have the risk of being hacked, or of losing access to your data forever?