4 ms·
I'm one of the weirdos who doesn't have a smart phone. What are my options? I went to the page on "configuring 2FA for your account" at https://docs.github.com
by eesmith 4y ago
I'm one of the weirdos who doesn't have a smart phone. What are my options?
I went to the page on "configuring 2FA for your account" at https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication https://docs.github.com/en/authentication/securing-your-acco... and it was ... not that helpful. All of the options seemed to depend primarily on mobile phones or text messages.
I guess I need to use text messages?
The linked-to article says there are other options, like physical security keys, but the GitHub page says:
> After you configure 2FA, using a time-based one-time password (TOTP) mobile app, or via text message, you can add a security key, like a fingerprint reader or Windows Hello.
and at https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/about-two-factor-authentication https://docs.github.com/en/authentication/securing-your-acco...
> For GitHub, the second form of authentication is a code that's generated by an application on your mobile device or sent as a text message (SMS).
- ThrowawayTestr 4y agoInstall a desktop authenticator app.
- eesmith 4y agoHow would I use it for GitHub? The documentation says "mobile device." I've never used these these programs before, and don't understand how they go together. How do I configure the app to connect to GitHub? How does the app help me log in? Do you have a pointer to a step-by-step walk-through?
- johdo 4y agoThey give you a secret, in the form of a QR code (for smartphone users) or a text string. You put the secret string in a password manager that supports one time code generation, like Gopass or KeepassXC. When you login with your user name and password, the 2FA adds a second step where it asks for a "one time code", which your password manager provides. That code is temporary and only works for a short time frame. In my case I use Gopass ( https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass ) and it's as simple as adding a field like --- totp: thesecretstringblahblah at the end of my password entries and the app will treat that field as the source to generate one time codes. There's a browser addon and all I have to do is click the one time code and CTRL+V it into the field.
- eesmith 4y agoThank you for the details, and pointer to a solution. I've just installed gopass. I also (in looking through other threads) found https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass and by reading the code learned how TOTP works.
- rcarr 4y agoI'd be surprised if they didn't support yubikeys Edit: Info here https://www.yubico.com/works-with-yubikey/catalog/github/ https://www.yubico.com/works-with-yubikey/catalog/github/
- ostenning 4y agoThis looks really cool. Im paranoid about losing my phone and having a hardware key as a necklace or bracelet could be a decent option. What are other benefits of using something like this? Is it possible to use this to store normal passwords and use them for logins?
- eesmith 4y agoThe video clearly shows at https://youtu.be/GTjGJ5WQqLA https://youtu.be/GTjGJ5WQqLA that registering a yubikey first requires a "TOTP app on your mobile device." Without a smart phone, how do I do that?
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- rcarr 4y agoAs many others have stated, you can achieve the same thing with a desktop application. If you’re on a Mac, all you have to do is right click a QR verification image, select the appropriate setting from the menu and the built in keychain will automatically set the codes up for you and auto fill when you encounter them. I’m sure there are similar desktop solutions on other platforms. Even if you couldn’t use a desktop solution, if you really cared that much about maintaining your access to a free product, you could purchase a second hand smartphone for very little money and use it solely for code generators. If you have privacy concerns you can keep it switched off and stored in a metal protein or cocktail shaker as a cheap faraday cage. Alternatively, you could host your own git server using gittea or similar or seek a commercial competitor product with more lax security requirements. No one is entitled to give you something for free. Asking you to use 2FA in this day and age is not a big ask. So are you asking a genuine question or are you being a contrarian for the sake of it?
- noman-land 4y agoThey support hardware security keys like Yubikey.
- justinclift 4y agoDoesn't the above comment say they only support Yubikeys after 2FA has been set up with a smart phone?
- computerfriend 4y agoYubiKeys also support TOTP.
- eesmith 4y agoHow would I use it to register 2FA for GitHub? I haven't found a description of the process, and I don't understand how it's supposed to work.
- computerfriend 4y agohttps://docs.yubico.com/software/yubikey/tools/ykman/OATH_Commands.html#ykman-oath-accounts-options-command-args https://docs.yubico.com/software/yubikey/tools/ykman/OATH_Co...
- justinclift 4y agoDoesn't seem to help with the initial 2FA setup for GitHub?
- miohtama 4y agoTOTP (time-based authentication codes) is an open RFC standard and you can run two-factor application on any device. This includes - Desktop applications - Web browsers - Raspberry Pi / Uncommon Linux installations The actual source code to generate TOTP tokens is some thousands lines of Python - not that much.
- eesmith 4y agoThe GitHub documentation doesn't explain how to set it up. It only mentions TOTP apps in a smart phone.
- miohtama 4y agoI suggest you try "TOTP applications" in Google. There are hundreds of alternatives and it is not difficult to find one.
- eesmith 4y ago1) If something is a TOTP application, does that mean it works with every TOTP application? I know that not all web sites work in all browsers, and not all USB-C cables work for every situation (and most SOAP servers seemingly didn't interoperate at all). I don't know and that search won't tell me. 2) Does GitHub focus on mobile phones because that hardware provides a unique id or some other feature that isn't available from other platforms? I don't know, and that search won't tell me. 3) I did that search just now, and the top links from Google were almost all for mobile (or paid ads). The main exception was https://en.wikipedia.org/wiki/Comparison_of_OTP_applications https://en.wikipedia.org/wiki/Comparison_of_OTP_applications . 4) I start going through the list and see monthly fees, freemium model, one time payment license, and required hardware purchases. While others here pointed out a number of free solutions with licenses I'm already familiar with. The Paradox of Choice is not my friend.
- miohtama 4y agoThis is HackerNews so I have higher than average expection of how hackery people here are. If you are in doubt I suggest user forums like SuperUser.com and Reddit.
- deleted 4y ago[deleted]
- AtomicOrbital 4y agoGive your self a free phone number using Google voice
- eesmith 4y agoWhich helps ... how? I already have a feature phone.