4 ms·
GitHub will require all code contributors to use two-factor authentication
- lottamus 4y agoInteresting timing given the Heroku breach. Any correlation?
- Vladimof 4y ago> GitHub’s internal research shows that only around 16.5 percent of active users (roughly one in six) currently enable the enhanced security measures on their accounts
- akomtu 4y agoIn other words, github wants your phone number too. They even bothered to come up with a cute reason: increasing security in the age of supply chain attacks.
- pengaru 4y agoWhile this is certainly true in many places where SMS 2FA is being required, as others have noted you can just use TOTP oh github, see oathtool.
- marbu 4y agoAfaik github doesn't force you to reveal your phone number, you can setup OTP or U2F token instead.
- davidmichael 4y agoYou can use a security key or TOTP app instead of providing your phone number.
- emidln 4y agoGitHub does not have my phone number (although it's trivial to obtain). I use their TOPT 2FA.
- TheRealNGenius 4y agono, fuck this and fuck you
- yubitears 4y agoThe fact that these types of threads are filled with inaccurate FUD bordering on lies makes me even more convinced that practices like this are indeed necessary. Just like with Google, yes, you can setup 2FA on GitHub without giving them a phone number. It's very, very easy.
- MiddleEndian 4y agoI don't use Github, but it seems a little excessive. Does this apply to private repositories as well?
- alar44 4y agoIt's more shocking that you can even create accounts at all without MFA in this day and age, especially something like GitHub.
- selfhoster11 4y agoNot everything needs to be treated as a mission-critical account of the highest importance. I recently had an app for a home appliance ask me to set up 2FA. Yeah, sure, because my IoT dishwasher or plant monitor is such a critical respurce worth protecting. If someone really knows what they are doing, let them not use 2FA. GitHub is different from Facebook, in that we're supposed to know what we're doing with technology. Let hacking sort out the stragglers.
- alar44 4y ago"knows what they're doing" doesn't have anything to do with it. If you don't have MFA, your account is going to get compromised by one of the billion bots trying to get it. Tell me you don't understand basic security without telling me you don't understand basic security.
- RealStickman_ 4y agoI have a few accounts I view as valuable enough to enable 2FA on. This change in Github will just lead to me either being more annoyed or storing the TOTP generator code in my password manager.
- selfhoster11 4y agoThat's not how it works. I have strong randomly-generated passwords for most sites, and store them in a password manager that I only ever load on ~3 devices that I completely trust and own. Short of typing the password in on a compromised machine, a "forgot password" reset (via the website or customer support), or being incautious enough to log in via a phishing form, I see no way that my accounts can be compromised. And as I said, for some accounts, there are no consequences if they are compromised.
- kevincox 4y agoA better link: https://github.blog/2022-05-04-software-security-starts-with-the-developer-securing-developer-accounts-with-2fa/ https://github.blog/2022-05-04-software-security-starts-with...
- Kuinox 4y agoBut I don't want it. I use a password manager with a strong password protected with 2FA, my GitHub password is unique. Now I will have to put a 2FA key in it... Let me login with an ssh key at this point, it won't change anything for me.
- jwilk 4y agoMore discussion here: https://news.ycombinator.com/item?id=31273229 https://news.ycombinator.com/item?id=31273229