6 ms·

Anyone that uses Github day to day at work and for side projects should have already enabled it. When I think of what the "most important" account is to me, my

Anyone that uses Github day to day at work and for side projects should have already enabled it. When I think of what the "most important" account is to me, my Github page is pretty damn close to the top. Mine is currently 2FA with an automated script that will scan my Github and back everything up to GitLab (at least the "important" projects), which is also 2FA'd. Insane setup to protect data in one account but if I loose access it would be beyond a bad day for me.

WithinReason 5y ago
Am I the only one that thinks that 2FA actually increases the probability of losing access to an account? It's only a matter of losing the 2nd factor.
- bamboozled 5y ago
  Github has alternative recovery methods though too, such as 2FA over SMS.
  - Fuzzwah 4y ago
    And support can help out as long as you can show that you can ssh into a github host using the private key of one of the public ssh keys assigned to your account.
    - jrochkind1 4y ago
      That makes some sense, and seems to me a nice option. Is it documented anywhere that that is an option, that they will do that?
  - jwilk 4y ago
    Documented here: https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials https://docs.github.com/en/authentication/securing-your-acco...
- zhfliz 5y ago
  easily solved by adding multiple MFA options, e.g. multiple security keys.
- johannes1234321 5y ago
  For that there are the revoke code. And the backup phone number.
  - Biganon 4y ago
    Or even better than the one time codes they give you, you can simply store the secret itself, on a piece of paper in a safe.
- jason0597 5y ago
  What people should do is have a small SD card with all of their private keys and passwords stored away safely. This SD card should be kept in cold storage (e.g. in a safe where you keep personal belongings), and never be accessed unless in absolute emergency (lost your YubiKey etc and can't get in anywhere, etc.)
  - Lifelarper 4y ago
    SD cards are horrendous for long term storage. Probably the worst medium for such a task.
    - adamiscool8 4y ago
      What is the best? Cursory googling suggests SD cards last ~decades at normal usage [0], and in this context where it's barely accessed, maybe longer? [0] https://www.sdcard.org/consumers/faq https://www.sdcard.org/consumers/faq
      - 0x073 4y ago
        If you go to bluray.com you probably can read the same only for blu-ray. Better search for a neutral source.
      - _whiteCaps_ 4y ago
        I wrote some scripts to generate QR codes, then printed them to photo paper. https://github.com/alexjh/gpg-backup/blob/master/Makefile https://github.com/alexjh/gpg-backup/blob/master/Makefile Back then I thought that QR codes were a bit of a gimmick but now I'm way more confident that I'll be able to read them in the future.
      - Brian_K_White 4y ago
        laser print
      - justinclift 4y ago
        Probably depends on the quantity of data. If you're talking GB's or TB's of digital data, then maybe "archival grade" DVD's or BluRay's. https://www.verbatim.com.au/product-category/data-storage/optical-media/archival/ https://www.verbatim.com.au/product-category/data-storage/op... If it's instead just a few short strings of text (eg GH password recovery codes), then you could use physical storage. eg engrave the codes into something that'll survive extremes (granite?), and keep them in a fire proof safe. Or something along similar lines. Probably don't engrave into glass though, due to that potentially shattering in some situations.
- deadbunny 4y ago
  You can have multiple second factors. I have 2 YubiKeys (one on me, one in a safe place) and then I have the standard TOTP codes on my phone using Authy. If I manage to lose my phone, live and backup yubikeys then I have recovery codes. It's going to have to be something pretty drastic to cause me to loose all of that.
- rstuart4133 4y ago
  Well, I've lost control of accounts and I suspect a few of us have. Fortunately the one I lost wasn't important. But my response wasn't to turn off 2FA. It was the reverse - to turn on all forms of authentication made available, for all acccouts. If I lost control of it one way, I had another. By the by, if you read the spec, FIDO expects you to do this in preparation for the day you lose your token. So no you are not the only one - people think about it all the time.
- IYasha 4y ago
  No, we're here with you. I'm also wondering if being responsible for storing and using passwords is THAT BIG OF A DEAL??? Even mathematically, probabilities of two failing points are adding. I've been locked away from mail, banks and gods know what else just because I didn't have my phone or computer nearby, was in different country, in a place without network coverage, haven't paid for cell in time, etc. etc. etc. and absolutely positive that 2FA (at least that requiring on-line presence) is evil. The ONLY THING that can really protect and help you - is good HUMAN tech support. Where you can call, explain yourself, prove ownership and regain access to a service. Up to the point of having to go to of video-call office yourself and beyond. Yeah, I'm completely aware that some corporations don't even have humans (hello, Goolag!) employed - and trying to stay clear from them.
kevdev 5y ago
I don’t think that’s an insane setup at all. Losing access to GitHub would be bad for a lot of folks on HN I suspect. My GitHub has 2FA with Yubikeys and I am planning to do something similar to yours with backing up to a personal Gitea instance… once I get around to it.
- b112 5y ago
  Meanwhile, some use github once a year to file a bug report against an OSS project. Tiered access would be better here. No commits, repos without 2fa.
  - Symbiote 5y ago
    It's clear in the article's title, subtitle, first paragraph and bold quote thing that this does not affect someone handling issues and not code.
  - sudobash1 5y ago
    The post is talking about 2FA for > active contributors (for example, those who commit code, open or merge pull requests, use Actions, or publish packages) So it may not be required to simply file a bug report.
sebmellen 5y ago
Would you be able to share the GitHub to GitLab backup script?
rapind 5y ago
Nit pick, but I wanted to point out that backing up your cloud data (github) to another cloud (gitlab) is increasing (approximately doubling) your attack surface. Good for data retention though.
- LordDragonfang 5y ago
  This assumes that the "attacks" you're concerned with preventing are exfiltration of data, rather than mutation/deletion of data.
cardanome 5y ago
I just use different accounts for work and private stuff. For me 2FA is super annoying because I run my browsers in private mode and I restart them multiple times a day, so I have to sign in quite often. It effectively makes it much harder for me to keep my privacy. Not to mention loosing the freedom to log in to my accounts from everywhere without needing my devices. Things do get stolen/lost/destroyed and that is a more realistic threat for me than getting my password stolen.

WithinReason 5y ago

Am I the only one that thinks that 2FA actually increases the probability of losing access to an account? It's only a matter of losing the 2nd factor.

bamboozled 5y ago
Github has alternative recovery methods though too, such as 2FA over SMS.
- Fuzzwah 4y ago
  And support can help out as long as you can show that you can ssh into a github host using the private key of one of the public ssh keys assigned to your account.
  - jrochkind1 4y ago
    That makes some sense, and seems to me a nice option. Is it documented anywhere that that is an option, that they will do that?
- jwilk 4y ago
  Documented here: https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials https://docs.github.com/en/authentication/securing-your-acco...
zhfliz 5y ago
easily solved by adding multiple MFA options, e.g. multiple security keys.
johannes1234321 5y ago
For that there are the revoke code. And the backup phone number.
- Biganon 4y ago
  Or even better than the one time codes they give you, you can simply store the secret itself, on a piece of paper in a safe.
jason0597 5y ago
What people should do is have a small SD card with all of their private keys and passwords stored away safely. This SD card should be kept in cold storage (e.g. in a safe where you keep personal belongings), and never be accessed unless in absolute emergency (lost your YubiKey etc and can't get in anywhere, etc.)
- Lifelarper 4y ago
  SD cards are horrendous for long term storage. Probably the worst medium for such a task.
  - adamiscool8 4y ago
    What is the best? Cursory googling suggests SD cards last ~decades at normal usage [0], and in this context where it's barely accessed, maybe longer? [0] https://www.sdcard.org/consumers/faq https://www.sdcard.org/consumers/faq
    - 0x073 4y ago
      If you go to bluray.com you probably can read the same only for blu-ray. Better search for a neutral source.
    - _whiteCaps_ 4y ago
      I wrote some scripts to generate QR codes, then printed them to photo paper. https://github.com/alexjh/gpg-backup/blob/master/Makefile https://github.com/alexjh/gpg-backup/blob/master/Makefile Back then I thought that QR codes were a bit of a gimmick but now I'm way more confident that I'll be able to read them in the future.
    - Brian_K_White 4y ago
      laser print
    - justinclift 4y ago
      Probably depends on the quantity of data. If you're talking GB's or TB's of digital data, then maybe "archival grade" DVD's or BluRay's. https://www.verbatim.com.au/product-category/data-storage/optical-media/archival/ https://www.verbatim.com.au/product-category/data-storage/op... If it's instead just a few short strings of text (eg GH password recovery codes), then you could use physical storage. eg engrave the codes into something that'll survive extremes (granite?), and keep them in a fire proof safe. Or something along similar lines. Probably don't engrave into glass though, due to that potentially shattering in some situations.
deadbunny 4y ago
You can have multiple second factors. I have 2 YubiKeys (one on me, one in a safe place) and then I have the standard TOTP codes on my phone using Authy. If I manage to lose my phone, live and backup yubikeys then I have recovery codes. It's going to have to be something pretty drastic to cause me to loose all of that.
rstuart4133 4y ago
Well, I've lost control of accounts and I suspect a few of us have. Fortunately the one I lost wasn't important. But my response wasn't to turn off 2FA. It was the reverse - to turn on all forms of authentication made available, for all acccouts. If I lost control of it one way, I had another. By the by, if you read the spec, FIDO expects you to do this in preparation for the day you lose your token. So no you are not the only one - people think about it all the time.
IYasha 4y ago
No, we're here with you. I'm also wondering if being responsible for storing and using passwords is THAT BIG OF A DEAL??? Even mathematically, probabilities of two failing points are adding. I've been locked away from mail, banks and gods know what else just because I didn't have my phone or computer nearby, was in different country, in a place without network coverage, haven't paid for cell in time, etc. etc. etc. and absolutely positive that 2FA (at least that requiring on-line presence) is evil. The ONLY THING that can really protect and help you - is good HUMAN tech support. Where you can call, explain yourself, prove ownership and regain access to a service. Up to the point of having to go to of video-call office yourself and beyond. Yeah, I'm completely aware that some corporations don't even have humans (hello, Goolag!) employed - and trying to stay clear from them.

kevdev 5y ago

I don’t think that’s an insane setup at all. Losing access to GitHub would be bad for a lot of folks on HN I suspect. My GitHub has 2FA with Yubikeys and I am planning to do something similar to yours with backing up to a personal Gitea instance… once I get around to it.

b112 5y ago
Meanwhile, some use github once a year to file a bug report against an OSS project. Tiered access would be better here. No commits, repos without 2fa.
- Symbiote 5y ago
  It's clear in the article's title, subtitle, first paragraph and bold quote thing that this does not affect someone handling issues and not code.
- sudobash1 5y ago
  The post is talking about 2FA for > active contributors (for example, those who commit code, open or merge pull requests, use Actions, or publish packages) So it may not be required to simply file a bug report.

sebmellen 5y ago

Would you be able to share the GitHub to GitLab backup script?

rapind 5y ago

Nit pick, but I wanted to point out that backing up your cloud data (github) to another cloud (gitlab) is increasing (approximately doubling) your attack surface. Good for data retention though.

LordDragonfang 5y ago
This assumes that the "attacks" you're concerned with preventing are exfiltration of data, rather than mutation/deletion of data.

cardanome 5y ago

I just use different accounts for work and private stuff. For me 2FA is super annoying because I run my browsers in private mode and I restart them multiple times a day, so I have to sign in quite often. It effectively makes it much harder for me to keep my privacy. Not to mention loosing the freedom to log in to my accounts from everywhere without needing my devices. Things do get stolen/lost/destroyed and that is a more realistic threat for me than getting my password stolen.