11 ms·

GitHub will disable non-2FA accounts?

27 points by countWSS 3y ago

I just got a big splash in my profile page: GitHub users are now required to enable two-factor authentication as an additional security measure. Your activity on GitHub includes you in this requirement. You will need to enable two-factor authentication on your account before September 28, 2023, or be restricted from account actions.

sergiotapia 3y ago
I'm sick of 2FA, if I wasn't forced I wouldn't use it for anything.
- warrenm 3y ago
  Why would you intentionally not want to be more secure?
yungporko 3y ago
i swear the only thing that github actively work on is making it difficult to use. is there any similar free service that doesn't take an hour of troubleshooting every time you need to provide credentials?
Am4TIfIsER0ppos 3y ago
[flagged]
- mtmail 3y ago
  github supports 2FA using authentication challenges, those work without phones or phone numbers.
  - justinclift 3y ago
    Isn't that something that can only be set up after going through a process of enabling 2FA using your phone? Pretty sure I remember someone on here a few months ago trying to get GitHub 2FA set up, but as they have no (smart) phone there didn't seem to be any way of making it happen.
  - egberts1 3y ago
    Only a matter of time before they demand your phone number. You know, as part of their embrace, engulf, and extinguish strategy.
deleted 3y ago
[deleted]
jjgreen 3y ago
Other origins are available: https://gitlab.com/ https://gitlab.com/, https://codeberg.org/ https://codeberg.org/, ...
- countWSS 3y ago
  Thanks, but many orgs and projects are basically locked in to github and wouldn't move without consensus(unless Github gets really shitty).
  - jjgreen 3y ago
    True enough, crates.io being one of them https://github.com/rust-lang/crates.io/issues/326 https://github.com/rust-lang/crates.io/issues/326
stephenr 3y ago
So enable 2fa. What's the problem here?
- johngladtj 3y ago
  I don't like 2fa and don't want to use it.
  - warrenm 3y ago
    Guess you're allowed to not like something ...but not wanting to use something that demonstrably makes you more secure (and is practically cost-free) does not make you look good
- bsder 3y ago
  Because it's not about 2FA. It will almost certainly be some shitty "We'll SMS your phone" thing in order to get your phone number. And this will enable attacks from my phone that weren't there before. Which actually makes me less secure. It also means that Apple or Google can screw me on Github because they can lock me out of my phone.
  - jcotton42 3y ago
    Not only does GitHub not require SMS for 2FA, they discourage it https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication#configuring-two-factor-authentication-using-text-messages https://docs.github.com/en/authentication/securing-your-acco...
    - bsder 3y ago
      A TOTP phone app is the same problem as SMS--my phone is the authenticator. It also provides a bunch of attack vectors like DDoSing my authenticator in order to get me to accidentally approve something. And if my phone battery is dead, I can't log in. And if my phone is stolen, I'm screwed. None of these things improve MY security experience.
phendrenad2 3y ago
Github is just too annoying for use for personal projects now. This is the last straw for me. I already moved my projects to FTP.
- Reviving1514 3y ago
  Are you able to share some more info about your setup? How do you handle branches etc over FTP? My git usage is pretty basic but I've always been a bit uncomfortable about the idea of pushing my code to the "cloud" so would love to learn more.
  - phendrenad2 3y ago
    Well for personal projects, I have no need for branches really. My commit history (if I were using git) would be entirely linear. So I really just need backup copies of my code at various points in the past, in case I need to revert a file or diff to find a bug. FTP is fine for my purposes, I just tar my code and copy it up to the server.
  - vlod 3y ago
    Not sure if ftp is the most ideal way. That's how it was done in the old days and usually got screwed up with multiple people. If you have a server with ssh access, you can set up a 'bare' git repo (obviously you should back it up to somewhere else. i.e. s3 as a tar ball) and that should work for you.
Lanedo 3y ago
Speaking of solutions, when you want to avoid using a phone, there is oathtool. For example for a GitHub 2FA Link like this: otpauth://totp/GitHub:username?secret=BLAHBLUBBLAH&issuer=GitHub You extract the secret and use it like this: oathtool --totp=sha1 --base32 BLAHBLUBBLAH 268685
- gettodachoppa 3y ago
  Not on my dev PC now (and dont want to access GH on this one). How do you get that 'otpauth://totp/GitHub:username?secret=BLAHBLUBBLAH&issuer=GitHub' path? Is it something you have to grab from the browser console?
- mistrial9 3y ago
  what is that otpauth:// part about? $oathtool --totp - -b <enter 16digit code> 6digit result for MSFT-Github that works daily CLI; oathtool is packaged as part of OpenStack on GNU-Debian-Ubuntu
  - SaberTail 3y ago
    otpauth:// is a de-facto standard, since Google Authenticator uses it: https://github.com/google/google-authenticator/wiki/Key-Uri-Format https://github.com/google/google-authenticator/wiki/Key-Uri-... The TOTP QR codes decode to one of these URIs
vczf 3y ago
I was annoyed by this, because I really don't want to go back to relying on a third-party like Authy or Microsoft for 2FA, but I need to be able to sync my 2FA keys cross-platform and integrate with my backup system. Had the idea to store my 2FA inside keepass. To my delight, this feature already exists and is supported in KeepassXC and Keepass2Android.
- jasonjayr 3y ago
  That's a handy feature; but PROBABLY should keep your 2FA token in a separate place than your passwords. At the very least, keep them in a separate keepass database with a different password .....

grayhatter 3y ago

As a security geek, and someone who's written on how passwords should be considered harmful. Github is wrong here. If I'm not willing to participate in this security "upgrade", it will not meaningful increase my security. In fact there's plenty of contrived scenarios in where this will decrease security. Say I run a FOSS project and leave my 2fa at home when I leave for some vacation? And in that same time I get a report about a security bug. If I cant login to fix or even remove a binary. My users will be at risk! you'd better hope it's a short vacation. Also, as an existing user of 2fa on GH, GH's implemention can get fucked! It auto submits 2fa otps for you. I've been locked out of my account for HOURS, multiple times because I'll fat finger one extra key, or the wrong number without realizing it, only to have GH "helpfully" submit the wrong number, i wouldn't have, as the last chance before a lockout timer. > what's the problem here It's not anyone else responsibility to make security decisions for me. And if I wont play along with GH 2fa security rules, GH doesn't gain any security benefit themselves. Which means this new requirement can *only* make things worse. That's the problem. Also, I assume you didn't mean this comment to sound so dismissive, but that's definitely how it reads. Feels very much like your omitted preamble is "just do what GH tells you and don't complain".

warrenm 3y ago
>As a security geek, and someone who's written on how passwords should be considered harmful. Github is wrong here. If I'm not willing to participate in this security "upgrade", it will not meaningful increase my security. You must neither be a "security geek" nor "someone who's written on how passwords should be considered harmful" As an actual security geek, and one who has written on how to choose good passwords, I can assure you your worries are completely unfounded, and campaigning against 2fa is stupid at best
stephenr 3y ago
> there's plenty of contrived scenarios Well at least you used the right word, even if you didn't intend that meaning. If your OSS project has meaningful users, and a bus factor of one, it's already under those same risks every day you wake up, but it has the added risk of a malicious actor taking control of your account. > I assume you didn't mean this comment to sound so dismissive, but that's definitely how it reads. Feels very much like your omitted preamble is "just do what GH tells you and don't complain". I mean, I am pretty dismissive of anyone making such a fuss about 2FA. It's not hard to use, and the benefits far outweigh any slight inconvenience. As I said previously, the target audience for GitHub needs to use Git on a regular basis, which is at least several orders of magnitude more complex than entering an OTP occasionally when you login via the web.
- grayhatter 3y ago
  > Well at least you used the right word, even if you didn't intend that meaning. I used contrived, because I meant contrived. They're invented.... until they happen. While I'm pretty sure this will conflict with your world view. You don't understand the world in which I live better than me, and you don't understand my threat model better than I do. You'd convince a lot more people that you're right, if you even pretended like you believe that instead of acting like you're hot shit. > If your OSS project has meaningful users, and a bus factor of one, it's already under those same risks every day you wake up, but it has the added risk of a malicious actor taking control of your account. Passwords used correctly aren't less secure than passwords + 2fa. But they do increase the chance of lockout. And given human nature, if used incorrectly they might decrease it. > I mean, I am pretty dismissive of anyone making such a fuss about 2FA. It's not hard to use, and the benefits far outweigh any slight inconvenience. Well at least you're being honest about not caring about others. That's not nothing. But my advice to you, if you care about security, more than you care about being right, is to be less dismissive of people who think differently from you, maybe then you'll have a chance at convincing them of anything. Instead of what you're actually doing, which is trying to look cool on the Internet. > and the benefits far outweigh any slight inconvenience ... the target audience for GitHub needs to use Git on a regular basis, which is at least several orders of magnitude more complex than entering an OTP occasionally when you login via the web. to you... the benefit, inconvenient trade off is worth it to you... there are more scenarios than you can imagine. And I'd also argue you'd become better if you tried to fairly consider some of them, instead of being a douche. But you do make a point, it is more common that people who use gh more, are the most common users. It's not a good point, and it's what's known as a dick move, to everyone else that uses github slightly differently, but to hell with people different from you, right? sigh
  - stephenr 3y ago
    > They're invented.... until they happen. Well at least we're agreed your entire argument is based on made up theoretical scenarios, rather than the real world, where people's accounts are breached because of poor password security, literally on a daily basis. > Passwords used correctly aren't less secure than passwords + 2fa. What was that about acting like you're hot shit? There is essentially zero way for you to know that passwords are being "used correctly", because "used correctly" includes how they are stored and transmitted. You have no view into how the remote side stores or transmits passwords though. For all we know (yes this is a hyperbolic theoretical scenario), GitHub stores all passwords in plain text. Or md5'd, or some other equally laughable scenario. Or perhaps they log passwords during authentication. Or perhaps there's an unencrypted path between a load balancer and a backend application server, which is open to packet sniffing by peers in a datacenter, or any number of other issues that have shown to be real-world points of weakness to a password. A big chunk of the benefit of TOTP based 2FA is that it greatly reduces the risk of replay style attacks. If you get the OTP I send (through logs or packet sniffing or whatever) it holds no long-term risk. > Well at least you're being honest about not caring about others. Straw man much? I didn't say I don't care about others. I'm very comfortable with the level of help/advice/expertise I offer to people who ask for it. Nowhere in any comment I've seen on this post, has anyone asked for help or advice. A number of people have made ridiculously misleading, uninformed or just outright false statements, with absolute confidence. Hence why I said (in another comment, but still a reply to you): > I'm blaming humans for wilful ignorance and insisting that there is no solution to problems they haven't tried to solve. > there are more scenarios than you can imagine. I'm sure there is probably some scenario where having 2FA enabled is a strictly worse scenario than password security alone. But you'll want to have a pretty damn strong argument prepared, based on a real-world scenario before you should expect others to listen to what you have to say and take it seriously. Right now you sound like a kid making up excuses about why they can't eat their vegetables.
nonameiguess 3y ago
2FA is only required to login to the Github web app through your browser. You can perform API actions with a personal access token you can make as long-lived as you want, certainly long enough to last through a vacation.
- grayhatter 3y ago
  I'm not foolish enough to bring any access control device through customs. That includes sessions keys. So either I bring everything, or nothing, and nothing is the safer security decision.
  - saltcured 3y ago
    After reading through several of your comment chains on this thread, I suspect something like a yubico security key with PIN protection enabled may be your least-bad option for travel with a second factor. The USB A ones are flat and thin and so easily carried whether in pockets, wallets, on a keychain, or even on a temporary necklace. The hardware is supposed to be somewhat resistant to key extraction, and the PIN means someone cannot instantly use it if taken from you.
    - grayhatter 3y ago
      I have no problem with 2fa. I have both available on my GH account. I think it's a bad decision, but I've been using 2fa on GH for over 10 years. I'm not arguing for myself, I'm arguing for others and for what's correct. In my case, i'm fortunate enough that when I need to go through customs, I have the luxury of being able to leave my 2fa at home :)
ecesena 3y ago
You're restricted from some activities, not all. You already get asked for 2FA only for activities like changing team, adding ssh keys... not to commit. In your scenario, you'll just get these activities done after you're back. (FWIW 2fa can be enabled on any phone now, both with totp and passkeys.)
- mistrial9 3y ago
  .. and your entire meatspace life records including payment information is linked to your phone?
  - deleted 3y ago
    [deleted]

stephenr 3y ago
So? It's not like Google authenticator is the only TOTP client available. I really do have to wonder about the people who realised it's a problem to have no easy to use backup, but then apparently spent exactly zero minutes to try and find a solution.
- mattl 3y ago
  A lot of things suggested Google Authenticator, so a lot of people installed it and used it, which sucks because no backups, so a lot of people had problems.
- oskarw85 3y ago
  Hey Mr. Know-it-all There WILL be a situation where you know nothing. Maybe your refrigerator would die and the technician would be scheduled two weeks from now. You would write about it on HN and some asshole would write: So? It's not like shitty Samsung refrigerators is the only one model available. I really do have to wonder about people who choose refrigerators using R407c refrigerant where temperature glide causes compressor valves to wear out prematurely. People apparently spent exactly zero minutes to try and find a solution.
  - stephenr 3y ago
    I mean this is just a terrible analogy to start with. I guarantee you it's a lot quicker, easier and cheaper to change your TOTP authenticator than it is to change a fucking fridge. You clearly didn't understand the point I'm making so let me be more explicit: I don't expect people to know everything. As you allude to, it's impossible to know everything. What I do expect, is for people to learn and try to resolve problems they face, rather than just sticking their head in the sand and pretending there's nothing they can do. A more accurate analogy using your fridge example would be: Johnny buys a POS Samsung fridge. Unknown to Johnny, Samsung fridges use R407c refrigerant which causes the compressor valves to wear out prematurely. The compressor on his fridge needs to be replaced after just 3 years of use. Rather than asking others for advice on the issue, Johnny now tells anyone that will listen, that all fridges will all need their compressor replaced after 3 years. That's what's happening in this thread: zero requests for information or help about the issue; multiple posts claiming things that are factually incorrect, with absolute confidence.