3 ms·
Github allowed node-ipc maintainer to stay after he intentionally distributed malware. This move is just security theater in that light. What will 2FA do? Let y
by panny 4y ago
Github allowed node-ipc maintainer to stay after he intentionally distributed malware. This move is just security theater in that light. What will 2FA do? Let you be really really sure it was the maintainer who did it? Realistically, github wants your phone number for reasons.
- hoffs 4y agoThis is not a security measure against real maintainer going mental and breaking everything. I am sure you can understand that different problems need different measures.
- Borgz 4y agonpm only supports security keys and TOTP, not SMS. https://docs.npmjs.com/configuring-two-factor-authentication https://docs.npmjs.com/configuring-two-factor-authentication
- kalupa 4y agoI'm pretty sure GH wouldn't use SMS for this since it's provably not a very good way to handle MFA. Banks seem to have not caught on to this, unfortuntely