4 ms·

Gov ID would only work if you show it in person. A lot of people have a photocopy of ID. IP address is easy to fake. The main problem is with targeted attacks.

Gov ID would only work if you show it in person. A lot of people have a photocopy of ID. IP address is easy to fake. The main problem is with targeted attacks. That's why SMS not secure

godelski 7y ago
I think you're missing a key part of my point. > This is why there are different levels of security. But my GitHub isn't so sensitive that if I lose access I don't want anyone to ever get access. Yet at the same time it is sensitive enough (and GitHub is attacked enough) that I don't think just a user name and password is sufficient. Yes, there is stuff people would rather have destroyed than get into the wrong hands. But I personally can't think of any. But I do think we all agree that a password alone is not secure enough. What I'm saying is that there shouldn't be two choices. There should be middle grounds. SMS is not a great recovery tool for 2FA because it is trivial to fake. Specifically with my GitHub I'm okay with my security not being invulnerable to nation state actors. But I don't want it to be hacked because of a dictionary attack with some modifications. If someone has a copy of my passport then there's much bigger problems that I have than my GitHub being hacked. The key part here is that there should be varying levels of security. The two levels we have (no 2FA vs 2FA) is too small. * as to the IP: I was suggesting that it was being used in combination with other stuff. Not a standalone verification. Just like your phone number should never be a standalone verification. We're talking multifactor.
- Latty 7y ago
  The thing is, GitHub shouldn't care what you want here. GitHub is a social site, and the users accessing repositories are just as important as those that own them. You might not care if your account is compromised, but if other people trust your repoisitories and they get attacked through your compromised account, that is a problem.
anoncake 7y ago
> Gov ID would only work if you show it in person. A lot of people have a photocopy of ID. Sounds reasonable. What's important is that you can securely recover the account at all, not that it's cheap.

Gov ID would only work if you show it in person. A lot of people have a photocopy of ID. IP address is easy to fake. The main problem is with targeted attacks. That's why SMS not secure

godelski 7y ago

I think you're missing a key part of my point. > This is why there are different levels of security. But my GitHub isn't so sensitive that if I lose access I don't want anyone to ever get access. Yet at the same time it is sensitive enough (and GitHub is attacked enough) that I don't think just a user name and password is sufficient. Yes, there is stuff people would rather have destroyed than get into the wrong hands. But I personally can't think of any. But I do think we all agree that a password alone is not secure enough. What I'm saying is that there shouldn't be two choices. There should be middle grounds. SMS is not a great recovery tool for 2FA because it is trivial to fake. Specifically with my GitHub I'm okay with my security not being invulnerable to nation state actors. But I don't want it to be hacked because of a dictionary attack with some modifications. If someone has a copy of my passport then there's much bigger problems that I have than my GitHub being hacked. The key part here is that there should be varying levels of security. The two levels we have (no 2FA vs 2FA) is too small. * as to the IP: I was suggesting that it was being used in combination with other stuff. Not a standalone verification. Just like your phone number should never be a standalone verification. We're talking multifactor.

Latty 7y ago
The thing is, GitHub shouldn't care what you want here. GitHub is a social site, and the users accessing repositories are just as important as those that own them. You might not care if your account is compromised, but if other people trust your repoisitories and they get attacked through your compromised account, that is a problem.

anoncake 7y ago

> Gov ID would only work if you show it in person. A lot of people have a photocopy of ID. Sounds reasonable. What's important is that you can securely recover the account at all, not that it's cheap.