3 ms·

Free services with 2FA are a recipe for problems. You will eventually have your phone stop working, you will lose your hardware fob, and you will lose your reco

Free services with 2FA are a recipe for problems. You will eventually have your phone stop working, you will lose your hardware fob, and you will lose your recovery codes that you forgot where you hid. There is no paid support, so you get what you pay for. Trying to get back into your account, if it's even possible, will take a long time and lots of work. If you are abroad and need access, you might be screwed. If it's not hard to get back into your account at that point, their security sucks. I think we all need to consider the possibility of moving off of GitHub, or at least keeping a mirror of everything on another provider, and making sure any long-lived services that pull from GitHub know the other provider to use. You don't want an account lockout to mean you've lost all your work.

deleted 5y ago
[deleted]
throwntoday 5y ago
All great points and very common cases, yet services that force 2FA seem completely oblivious to this or just don't care about responsible users. In instances where it must be a phone number it is obviously for data mining. It is a lazy way to cater to the lowest common denominator of users who will eventually fall for a phishing scam or install some keylogger and have their password end up in a dump.
jpalomaki 5y ago
Having support that is able to resolve 2FA problem creates new issues - how to prevent attacker from social engineering their way around support to gain access to your account. It’s hard to verify the identity online, across borders. IMHO there’s no good answers on global scale. Identity should be handled on local level. Government already has process for issuing me new tokens even if I would loose all my existing ways of proving my identity. Local organizations know how to verify my identity using those tokens. I already put lots of trust on my own bank on this, so maybe they could also manage my digital identity.
- 0xbadcafebee 5y ago
  Other providers do recovery by asking for a "secret code" that was only transmitted to you when you first signed up, or you can tell them to put a passphrase on your account. The first is more like a recovery code (but smaller), the latter is a second password you never use for anything else. Another solution is for users to upload identification documents when they sign up for the service. To recover your account, the service asks you to provide the documents again. This way it doesn't matter what the locality is, and you can provide literally anything (a picture of a duck!). Some providers have asked me to send a copy of my Driver's License before, but I don't think I had provided it to them before recovery, so that wasn't great. A couple startups are beginning to build "identity" products that I imagine will cover a lot of this space. I expect soon there will be one company that everyone uses for identity, and then rather than be at the mercy of GitHub, we'll be at the mercy of Sauron's Eye.
anonymousCar 5y ago
Had this happen to me in November when Android 12 corrupted my pixel 5 and I didn't have backup codes. Altogether it took 2 months before I was able to access everything again, the last thing I got access back to was my Xbox lol
xcdzvyn 5y ago
> or at least keeping a mirror of everything on another provider, GitHub is a remote. This "mirror" is kept on your disk.
- xnyan 5y ago
  You would be surprised how many people develop directly from github, either by using github’s web editor or a third party editor. Even if one does not do this, poor backup hygiene is the norm not the exception - for most devs I would would be willing to bet a sizable sum that github is their most reliable and longest lasting repository of code they have.
blippage 5y ago
> I think we all need to consider the possibility of moving off of GitHub, I've come to that conclusion, too. I moaned and groaned when Microsoft bought GitHub, but did nothing about it. Now I've begun the migration process. I'd like to spell out some big-picture thoughts on 2FA. Security and convenience are antithetical to each other. Sometimes better solutions come along where you can have a little bit of both. But ultimately, they're trade-offs. Do you value security, or do you value convenience? And in what proportion? Furthermore, increasing security also increases fragility. There's more to go wrong. Posters here have been talking about losing their devices, and so forth. These are legitimate concerns. These points have rebuttals, such as recovery procedures, and so forth. OK, and you're sure grandma is up to the task, is she? All these convenience tools: they're easy to use until they aren't. So not only do you have to think about security vs convenience, you have to consider downside risks on both ends of the spectrum. It's not as easy as saying "moar security" and reading press reports about the advisability of such systems.
- jjav 5y ago
  > Do you value security, or do you value convenience? And in what proportion? Or to look at this from the threat analysis side, there are many different threat models and not everyone has the same ones. This is why it is so wrong for these cloud services to consider only one single threat model and impose it on everyone. Denial of service is also a consideration in threat modeling and 2FA does increase the risk of loss of access. Whether that's worth it depends entirely on other factors which will vary for each individual and group. It's never a clear cut answer. Personally I have TOTP enabled on my github account (not on a phone, that's too fragile) but that's because it makes sense for my use case. There are other provider accounts where I have no desire to ever enable 2FA because I value access from anywhere with only my memory far more. Cloud providers should not be making threat modeling decisions on behalf of users, each user needs to make their own. Another reason to self host most things, you can implement your own best policy.

deleted 5y ago

[deleted]

throwntoday 5y ago

All great points and very common cases, yet services that force 2FA seem completely oblivious to this or just don't care about responsible users. In instances where it must be a phone number it is obviously for data mining. It is a lazy way to cater to the lowest common denominator of users who will eventually fall for a phishing scam or install some keylogger and have their password end up in a dump.

jpalomaki 5y ago

Having support that is able to resolve 2FA problem creates new issues - how to prevent attacker from social engineering their way around support to gain access to your account. It’s hard to verify the identity online, across borders. IMHO there’s no good answers on global scale. Identity should be handled on local level. Government already has process for issuing me new tokens even if I would loose all my existing ways of proving my identity. Local organizations know how to verify my identity using those tokens. I already put lots of trust on my own bank on this, so maybe they could also manage my digital identity.

0xbadcafebee 5y ago
Other providers do recovery by asking for a "secret code" that was only transmitted to you when you first signed up, or you can tell them to put a passphrase on your account. The first is more like a recovery code (but smaller), the latter is a second password you never use for anything else. Another solution is for users to upload identification documents when they sign up for the service. To recover your account, the service asks you to provide the documents again. This way it doesn't matter what the locality is, and you can provide literally anything (a picture of a duck!). Some providers have asked me to send a copy of my Driver's License before, but I don't think I had provided it to them before recovery, so that wasn't great. A couple startups are beginning to build "identity" products that I imagine will cover a lot of this space. I expect soon there will be one company that everyone uses for identity, and then rather than be at the mercy of GitHub, we'll be at the mercy of Sauron's Eye.

anonymousCar 5y ago

Had this happen to me in November when Android 12 corrupted my pixel 5 and I didn't have backup codes. Altogether it took 2 months before I was able to access everything again, the last thing I got access back to was my Xbox lol

xcdzvyn 5y ago

> or at least keeping a mirror of everything on another provider, GitHub is a remote. This "mirror" is kept on your disk.

xnyan 5y ago
You would be surprised how many people develop directly from github, either by using github’s web editor or a third party editor. Even if one does not do this, poor backup hygiene is the norm not the exception - for most devs I would would be willing to bet a sizable sum that github is their most reliable and longest lasting repository of code they have.

blippage 5y ago

> I think we all need to consider the possibility of moving off of GitHub, I've come to that conclusion, too. I moaned and groaned when Microsoft bought GitHub, but did nothing about it. Now I've begun the migration process. I'd like to spell out some big-picture thoughts on 2FA. Security and convenience are antithetical to each other. Sometimes better solutions come along where you can have a little bit of both. But ultimately, they're trade-offs. Do you value security, or do you value convenience? And in what proportion? Furthermore, increasing security also increases fragility. There's more to go wrong. Posters here have been talking about losing their devices, and so forth. These are legitimate concerns. These points have rebuttals, such as recovery procedures, and so forth. OK, and you're sure grandma is up to the task, is she? All these convenience tools: they're easy to use until they aren't. So not only do you have to think about security vs convenience, you have to consider downside risks on both ends of the spectrum. It's not as easy as saying "moar security" and reading press reports about the advisability of such systems.

jjav 5y ago
> Do you value security, or do you value convenience? And in what proportion? Or to look at this from the threat analysis side, there are many different threat models and not everyone has the same ones. This is why it is so wrong for these cloud services to consider only one single threat model and impose it on everyone. Denial of service is also a consideration in threat modeling and 2FA does increase the risk of loss of access. Whether that's worth it depends entirely on other factors which will vary for each individual and group. It's never a clear cut answer. Personally I have TOTP enabled on my github account (not on a phone, that's too fragile) but that's because it makes sense for my use case. There are other provider accounts where I have no desire to ever enable 2FA because I value access from anywhere with only my memory far more. Cloud providers should not be making threat modeling decisions on behalf of users, each user needs to make their own. Another reason to self host most things, you can implement your own best policy.