6 ms·

I don't have a cellphone or usb dongle and don't want them.

• waynesonfire 4y ago
  you can get a tiny one and keep it plugged into your laptop
  • mzs 4y ago
    Okay so which one do I buy and how do I use it with ssh. The documentation is not specific.
    • waynesonfire 4y ago
      yubikey 5 nano, get two. i use it w/ ssh. took a little googling to integrate the gpg authentications key w/ ssh. instead of using ssh-agent, you'd use gpg-agent to manage the keys. there are other integrations, for example, i can also unlock my mac w/ the yubikey.
      • newjersey 4y ago
        On gnome on fedora at least, I can have my gpg automatically unlock when I login to the desktop. I already have two steps on GitHub with the authy app but I don't get it. Why is it not good enough to send an email with a code when signing in without a cookie for people who don't want to opt in to two steps? The way I see it my authy is a vulnerability because if someone were to guess my authy phone number, they could technically grab all of my TOTP. I don't get this spoon feeding. I mean I would sign up to two steps where I can but something doesn't feel right about the lack of choice.
        • waynesonfire 4y ago
          i hate checking email or looking at my phone for two step auth. either choice requires me to access another system. It requires far fewer steps to just tap the button on the side of the yubikey.
      • mzs 4y ago
        It's pricey but looks like it won't be too warty, thanks. https://forums.freebsd.org/threads/yubikey-5-nfc-not-working-with-yubioath-desktop-py-yubikey-manager-and-py-yubikey-manage-qt.78025/ https://forums.freebsd.org/threads/yubikey-5-nfc-not-working...
    • newjersey 4y ago
      > Okay so which one do I buy and how do I use it with ssh. The documentation is not specific. Oh crap, I was thinking this doesn't affect me because I already have two factors authentication but yes if I need to fish out my phone every time I need to git something (I use sash, not tokens) that requires authentication, I will definitely minimize what I do on GitHub.
    • saltcured 4y ago
      The github.com documentation pages I read on this topic yesterday said the MFA requirement was for web sign-on and https GIT repo URLs. It explicitly said that SSH-based git repo access would not be affected. Has anyone seen contradictory statements published by github? Edit to add: I mean SSH git access using a keypair registered with your account. (I don't know if there is some legacy option to use SSH with passwords, which I imagine would be discontinued if not already.)
• jrochkind1 4y ago
  As far as complying with 2FA requirements without these, if TOTP is an option, one way is to use Authy with desktop client. It's free. How secure it is I can't really say. But it will allow you to access services requiring TOTP without a cellphone or usb dongle. https://authy.com/blog/introducing-authy-for-your-personal-computer/ https://authy.com/blog/introducing-authy-for-your-personal-c...
  • eulers_secret 4y ago
    If you're as crazy as I am, it looks like oauthtool+gnupg2 can do TOTP via the command-line on Linux as well. I think it's just another function that my homeserver will take over (or maybe a container). At least I can easily integrate this new info into my backup system, unlike apps on my phone...
    • jrochkind1 4y ago
      There is also an Authy linux app, but, sure, open source command-line sounds great.