5 ms·

This is just shenanigans to get our phone numbers. As if forcing keys over password was not bad enough. I wonder if I will be able to connect and pull from a p

This is just shenanigans to get our phone numbers. As if forcing keys over password was not bad enough. I wonder if I will be able to connect and pull from a private repository without 2FA. Otherwise my personal web server setup breaks.

Avamander 4y ago
> I wonder if I will be able to connect and pull from a private repository without 2FA. Per-repository deploy tokens should function for that purpose.
wiredfool 4y ago
You can easily use TOTP or webauthn as a second factor.
loloquwowndueo 4y ago
You don’t need to provide a phone number to enable 2FA. GitHub supports OATH applications that generate one-time codes and webauthn so you can use it with a yubikey and not bother with pesky codes.
sundaeofshock 4y ago
You are not required to use your phone number for 2FA. In fact, they discourage users from using SMS for 2FA.
- HeckFeck 4y ago
  I wish the makers of Google Suite thought the same way.
  - singlow 4y ago
    If you are admin of a Google domain then you can disable SMS for 2fa and require either a hardware key or TOTP.
    - HeckFeck 4y ago
      I wasn't aware that was configurable (we were told SMS or Gauthenticator app), I wanted just a OTP code. I'd be delighted if that's really available. I'll chase it up with our admin. Thanks
      - singlow 4y ago
        Often many 2-factor setup screens will directly reference GAuthenticator, but it is just a TOTP app so you can use any TOTP app with a GAuthenticator qr code, and you can usually get the secret text for copy paste to a desktop TOTP in case you can't scan a qr code, but i have seen some apps that don't make that easy. There is desktop software that will read qr codes from the screen. In Google's Workspace Admin just got to: Security -> Authentication -> 2-step verification Then choose "Any except verification codes via text, phone call". This allows them to use TOTP, a security key such as a usb key or if they have a phone like a Pixel or iPhone that has a security key built in, or TOTP. They can also approve logins from another device that is already logged in, and can generate long-lived backup codes. You can also allow only a security key, no TOTP or prompts and if, you do that, you can disable backup codes as well.
- capableweb 4y ago
  > In fact, they discourage users from using SMS for 2FA. Obviously, but I don't think they did good enough. Why enable SMS 2FA at all? It's horribly insecure.
tekla 4y ago
Good thing I dont need to use my phone number

Avamander 4y ago

> I wonder if I will be able to connect and pull from a private repository without 2FA. Per-repository deploy tokens should function for that purpose.

wiredfool 4y ago

You can easily use TOTP or webauthn as a second factor.

loloquwowndueo 4y ago

You don’t need to provide a phone number to enable 2FA. GitHub supports OATH applications that generate one-time codes and webauthn so you can use it with a yubikey and not bother with pesky codes.

sundaeofshock 4y ago

You are not required to use your phone number for 2FA. In fact, they discourage users from using SMS for 2FA.

HeckFeck 4y ago
I wish the makers of Google Suite thought the same way.
- singlow 4y ago
  If you are admin of a Google domain then you can disable SMS for 2fa and require either a hardware key or TOTP.
  - HeckFeck 4y ago
    I wasn't aware that was configurable (we were told SMS or Gauthenticator app), I wanted just a OTP code. I'd be delighted if that's really available. I'll chase it up with our admin. Thanks
    - singlow 4y ago
      Often many 2-factor setup screens will directly reference GAuthenticator, but it is just a TOTP app so you can use any TOTP app with a GAuthenticator qr code, and you can usually get the secret text for copy paste to a desktop TOTP in case you can't scan a qr code, but i have seen some apps that don't make that easy. There is desktop software that will read qr codes from the screen. In Google's Workspace Admin just got to: Security -> Authentication -> 2-step verification Then choose "Any except verification codes via text, phone call". This allows them to use TOTP, a security key such as a usb key or if they have a phone like a Pixel or iPhone that has a security key built in, or TOTP. They can also approve logins from another device that is already logged in, and can generate long-lived backup codes. You can also allow only a security key, no TOTP or prompts and if, you do that, you can disable backup codes as well.
capableweb 4y ago
> In fact, they discourage users from using SMS for 2FA. Obviously, but I don't think they did good enough. Why enable SMS 2FA at all? It's horribly insecure.

tekla 4y ago

Good thing I dont need to use my phone number