4 ms·
> Today, only approximately 16.5% of active GitHub users and 6.44% of npm users use one or more forms of 2FA. That's atrociously low. I know it's caveat emptor
by koolba 5y ago
> Today, only approximately 16.5% of active GitHub users and 6.44% of npm users use one or more forms of 2FA.
That's atrociously low. I know it's caveat emptor when it comes to FOSS, particularly as the nominal price is usually $0, but that really needs to be bumped up for anyone that is publishing packages to a public registry.
I hope they both mandate it for NPM and publicly flog^Wflag any existing accounts as "2FA Not Enabled" so that users can use that information to make their own choices about which dependencies to include in their projects.
- svnpenn 5y ago> flag any existing accounts as "2FA Not Enabled" so that users can use that information to make their own choices about which dependencies to include in their projects. Fine, do that. I don't care. Just don't force me to use 2FA if I don't want to. I prefer the convenience over the extra security. This change removes that choice from everyone.
- deadbunny 5y agoHave you tried using something like a YubiKey? You literally just tap it and you're authenticated. No pulling out your phone and typing anything.
- svnpenn 5y agoI don't want to use 2FA, and I certainly don't want to have to buy something to use 2FA. What is hard to understand about that?
- deadbunny 5y agoIt sounded like you didn't like the hassle of using TOTP from a phone which is most people's complaint when using 2FA. I was offering a basically zero friction, more user friendly alternative which provides both convenience and security.
- Beltalowda 5y agoBut then I need to buy a YubiKey (€45), and set it up on my Linux machines which seems to require some PAM stuff, and lose one of the two USB ports on my laptop, and carry it around, and make a plan for when I lose it or when it breaks. And the advantage is ... I don't know? If you have a strong random non-reused password I'm not seeing any. The only hypothetical advantage is when someone compromises your email account or desktop, but support departments tend to just reset 2FA if asked, so it's not actually a protection.
- deadbunny 5y agoNo need for "PAM stuff" on Linux, plug it in and it's ready to use as a 2FA webauthn device. I think you can use it for PAM but I've never tried. You can set it up as a GPG smart card if you're that way inclined (which also means you can use it as an SSH private key as well). The advantage there is that your private keys are never on your machine which means they stay secure even if your machine is compromised which is nice. As for MFA (YubiKey or otherwise), I believe the "hassle" is worth the inconvenience. It means that of my (single site, very complex) passwords are compromised in any way my accounts will remain secure long enough for me to change passwords.
- jgerrish 5y agoMercy me, that's some mighty smart incentive centered design you done schemed up.
- technion 5y agoIt's actually higher than I expected. I've mandated a lot of different contractors use MFA over the years and the fighting back has been depressing.