4 ms·

I'd be surprised if they didn't support yubikeys Edit: Info here https://www.yubico.com/works-with-yubikey/catalog/github/ https://www.yubico.com/works-with-yu

by rcarr 4y ago

I'd be surprised if they didn't support yubikeys Edit: Info here https://www.yubico.com/works-with-yubikey/catalog/github/ https://www.yubico.com/works-with-yubikey/catalog/github/

ostenning 4y ago
This looks really cool. Im paranoid about losing my phone and having a hardware key as a necklace or bracelet could be a decent option. What are other benefits of using something like this? Is it possible to use this to store normal passwords and use them for logins?
eesmith 4y ago
The video clearly shows at https://youtu.be/GTjGJ5WQqLA https://youtu.be/GTjGJ5WQqLA that registering a yubikey first requires a "TOTP app on your mobile device." Without a smart phone, how do I do that?
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
- rcarr 4y ago
  As many others have stated, you can achieve the same thing with a desktop application. If you’re on a Mac, all you have to do is right click a QR verification image, select the appropriate setting from the menu and the built in keychain will automatically set the codes up for you and auto fill when you encounter them. I’m sure there are similar desktop solutions on other platforms. Even if you couldn’t use a desktop solution, if you really cared that much about maintaining your access to a free product, you could purchase a second hand smartphone for very little money and use it solely for code generators. If you have privacy concerns you can keep it switched off and stored in a metal protein or cocktail shaker as a cheap faraday cage. Alternatively, you could host your own git server using gittea or similar or seek a commercial competitor product with more lax security requirements. No one is entitled to give you something for free. Asking you to use 2FA in this day and age is not a big ask. So are you asking a genuine question or are you being a contrarian for the sake of it?
  - eesmith 4y ago
    > If you’re on a Mac, all you have to do is right click a QR verification image Thank you. I have no idea how the process works. I've never used TOTP, never seen people use it, and not seen documentation of how it works, much less works with GitHub. > if you really cared that much about maintaining your access to a free product The question was more if this would mean the end of my using GitHub. There is one FOSS project that I contribute to there. Otherwise I use paid Mercurial hosting on Sourcehut, which does not require TOTP. (At least not yet.) > If you have privacy concerns I don't think I have the self-control to use a mobile device in moderation. I do not want to be like the large number of people I see who go around with their phone in their face. I quit Facebook, and soft drinks, for similar reasons - some things I cannot self-moderate. > So are you asking a genuine question or are you being a contrarian for the sake of it? I think it's more that change, after decades of doing things a certain way seemingly without problems, upsets me, so I'm looking for hand-holding.
    - rcarr 4y ago
      Sorry for being a bit harsh, I've become a bit jaded to interactions on here. If you're using a Mac this explains it fairly well: https://www.macworld.com/article/626700/verification-codes-apple-passwords.html https://www.macworld.com/article/626700/verification-codes-a... If the verification code doesn't autofill for whatever reason (doesn't with the aws console login for me) you can type 'cmd+,' to get the safari settings up, go to the passwords tab, and then find the website you're looking for and you'll be able to copy the verification code. Obviously this requires you to use safari, there's probably a similar solution for chrome or other browsers but I don't know.
      - eesmith 4y ago
        That was an eye-opener. I didn't realize those QR codes could be auto-detected by Safari (and perhaps other browsers too), and had UI around it. Thanks for the pointer!

by rcarr 4y ago

I'd be surprised if they didn't support yubikeys Edit: Info here https://www.yubico.com/works-with-yubikey/catalog/github/ https://www.yubico.com/works-with-yubikey/catalog/github/

ostenning 4y ago

This looks really cool. Im paranoid about losing my phone and having a hardware key as a necklace or bracelet could be a decent option. What are other benefits of using something like this? Is it possible to use this to store normal passwords and use them for logins?

eesmith 4y ago

The video clearly shows at https://youtu.be/GTjGJ5WQqLA https://youtu.be/GTjGJ5WQqLA that registering a yubikey first requires a "TOTP app on your mobile device." Without a smart phone, how do I do that?

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
rcarr 4y ago
As many others have stated, you can achieve the same thing with a desktop application. If you’re on a Mac, all you have to do is right click a QR verification image, select the appropriate setting from the menu and the built in keychain will automatically set the codes up for you and auto fill when you encounter them. I’m sure there are similar desktop solutions on other platforms. Even if you couldn’t use a desktop solution, if you really cared that much about maintaining your access to a free product, you could purchase a second hand smartphone for very little money and use it solely for code generators. If you have privacy concerns you can keep it switched off and stored in a metal protein or cocktail shaker as a cheap faraday cage. Alternatively, you could host your own git server using gittea or similar or seek a commercial competitor product with more lax security requirements. No one is entitled to give you something for free. Asking you to use 2FA in this day and age is not a big ask. So are you asking a genuine question or are you being a contrarian for the sake of it?
- eesmith 4y ago
  > If you’re on a Mac, all you have to do is right click a QR verification image Thank you. I have no idea how the process works. I've never used TOTP, never seen people use it, and not seen documentation of how it works, much less works with GitHub. > if you really cared that much about maintaining your access to a free product The question was more if this would mean the end of my using GitHub. There is one FOSS project that I contribute to there. Otherwise I use paid Mercurial hosting on Sourcehut, which does not require TOTP. (At least not yet.) > If you have privacy concerns I don't think I have the self-control to use a mobile device in moderation. I do not want to be like the large number of people I see who go around with their phone in their face. I quit Facebook, and soft drinks, for similar reasons - some things I cannot self-moderate. > So are you asking a genuine question or are you being a contrarian for the sake of it? I think it's more that change, after decades of doing things a certain way seemingly without problems, upsets me, so I'm looking for hand-holding.
  - rcarr 4y ago
    Sorry for being a bit harsh, I've become a bit jaded to interactions on here. If you're using a Mac this explains it fairly well: https://www.macworld.com/article/626700/verification-codes-apple-passwords.html https://www.macworld.com/article/626700/verification-codes-a... If the verification code doesn't autofill for whatever reason (doesn't with the aws console login for me) you can type 'cmd+,' to get the safari settings up, go to the passwords tab, and then find the website you're looking for and you'll be able to copy the verification code. Obviously this requires you to use safari, there's probably a similar solution for chrome or other browsers but I don't know.
    - eesmith 4y ago
      That was an eye-opener. I didn't realize those QR codes could be auto-detected by Safari (and perhaps other browsers too), and had UI around it. Thanks for the pointer!