3 ms·
Use any password manager (you should already be using one) that has TOTP support such as keepassxc or 1Password. No cellphone needed.
by scrollaway 4y ago
Use any password manager (you should already be using one) that has TOTP support such as keepassxc or 1Password. No cellphone needed.
- throwntoday 4y agoWhy should someone be using a password manager? Generating needlessly complex, unique passwords for each service seems like a good way to lock yourself out of your own accounts in an emergency. Laptop or phone stolen? No access to your own devices? Oops guess you can't login to anything.
- technovader 4y agobecause it makes your passwords significantly less likely to be guessed
- throwntoday 4y agoI don't know of a single competent service that allows you to just guess passwords more than a few times.
- Beltalowda 4y agoThe biggest problem is re-using passwords. Remember when that LinkedIn password database with plaintext/md5 (easily brute-forced) was leaked a few years back? And who knows what's going on with Heroku right now. There's been dozens, hundreds, thousands of leaks like this, from well known sites like LinkedIn to that small independent webshop where you ordered something a few years ago. And for at least some people those credentials that worked on LinkedIn may also work on GitHub. Having a unique password per service solves that particular issue. But you're right that there's a "price" in that losing access to your passwords would leave you screwed. I'd strongly recommend making sure you at least memorize your email password, as well as backing it up in several places.
- tomjen3 4y agoThat is a scenario that is a lot less likely than some service having losing control over your password. If you are concerned about it, you can always write down the password into a physical notebook.
- throwntoday 4y agoWhat about trying to login on someone elses device? Or your system crashing/corrupting? The scenarios in which you are unable to use your password manager are far more likely than you're making it seem.
- mzs 4y agoI use a key-pair for github ssh. I don't use any password managers, instead I have unique long passwords. What's my second factor without a cellphone?
- TimWolla 4y agoYou can use OATHTOOL [1] on the command line or even roll your own TOTP implementation [2] in just a few lines of code in your favorite programming language. [1] https://www.nongnu.org/oath-toolkit/oathtool.1.html https://www.nongnu.org/oath-toolkit/oathtool.1.html [2] https://datatracker.ietf.org/doc/html/rfc6238 https://datatracker.ietf.org/doc/html/rfc6238
- potatoz2 4y agoI don’t believe this 2FA announcement applies to SSH access. The public key you use is already 2FA enabled, in a sense (the key is what you have, the password to unlock it what you know). This applies to logging in to the GitHub Web application.