7 ms·

So enable 2fa. What's the problem here?

by stephenr 3y ago

johngladtj 3y ago
I don't like 2fa and don't want to use it.
- warrenm 3y ago
  Guess you're allowed to not like something ...but not wanting to use something that demonstrably makes you more secure (and is practically cost-free) does not make you look good
bsder 3y ago
Because it's not about 2FA. It will almost certainly be some shitty "We'll SMS your phone" thing in order to get your phone number. And this will enable attacks from my phone that weren't there before. Which actually makes me less secure. It also means that Apple or Google can screw me on Github because they can lock me out of my phone.
- jcotton42 3y ago
  Not only does GitHub not require SMS for 2FA, they discourage it https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication#configuring-two-factor-authentication-using-text-messages https://docs.github.com/en/authentication/securing-your-acco...
  - bsder 3y ago
    A TOTP phone app is the same problem as SMS--my phone is the authenticator. It also provides a bunch of attack vectors like DDoSing my authenticator in order to get me to accidentally approve something. And if my phone battery is dead, I can't log in. And if my phone is stolen, I'm screwed. None of these things improve MY security experience.
    - russelg 3y ago
      The main issue with SMS TOTP seems to be that phone numbers can be trivially stolen via social engineering, or less trivially via direct cell attacks. A TOTP app is effectively immune to both of these attacks. All your concerns are still quite valid however.
countWSS 3y ago
Its a huge change and increased burden to ordinary users and "ordering users to use 2FA or else" is not the tone i'd expect from website that thrive on voluntary participation, suddenly dictating that i could only login with specific setup from specific devices.
- stephenr 3y ago
  By that logic, they should remove passwords too and just work on the honour system. Seriously though, if using a TOTP generator or physical security key is a "burden" for someone, I really doubt they're the target audience for GitHub. The benefits of 2FA are well known, and even if you have to enter the code manually (ie no browser integration) it's still arguably several orders of magnitude simpler in concept than most git operations.
  - lesserknowndan 3y ago
    Everything is fine until you realise the person that had 2FA for your organisation’s github admin account left the company six months ago and has deleted their 2FA key. Also phones don’t seem to think it’s important to backup 2FA secrets so when you move devices you’re out of luck.
    - warrenm 3y ago
      > Everything is fine until you realise the person that had 2FA for your organisation’s github admin account left the company six months ago and has deleted their 2FA key. What "organization" only has one person with access to the repositories? These hypotheticals become goofier with each iteration
      - lesserknowndan 3y ago
        Access to the Owner privilege is very different to having access to repositories. Many small organisations may only have one person with an Owner account for the very reason that they don’t _need_ to have multiple people with access to that account as you share out access to repositories to team members that have less privileged accounts. It is much “goofier” to assume that every organisation using Github has two people that have been granted an “Owner” level account.
grayhatter 3y ago
As a security geek, and someone who's written on how passwords should be considered harmful. Github is wrong here. If I'm not willing to participate in this security "upgrade", it will not meaningful increase my security. In fact there's plenty of contrived scenarios in where this will decrease security. Say I run a FOSS project and leave my 2fa at home when I leave for some vacation? And in that same time I get a report about a security bug. If I cant login to fix or even remove a binary. My users will be at risk! you'd better hope it's a short vacation. Also, as an existing user of 2fa on GH, GH's implemention can get fucked! It auto submits 2fa otps for you. I've been locked out of my account for HOURS, multiple times because I'll fat finger one extra key, or the wrong number without realizing it, only to have GH "helpfully" submit the wrong number, i wouldn't have, as the last chance before a lockout timer. > what's the problem here It's not anyone else responsibility to make security decisions for me. And if I wont play along with GH 2fa security rules, GH doesn't gain any security benefit themselves. Which means this new requirement can *only* make things worse. That's the problem. Also, I assume you didn't mean this comment to sound so dismissive, but that's definitely how it reads. Feels very much like your omitted preamble is "just do what GH tells you and don't complain".
- warrenm 3y ago
  >As a security geek, and someone who's written on how passwords should be considered harmful. Github is wrong here. If I'm not willing to participate in this security "upgrade", it will not meaningful increase my security. You must neither be a "security geek" nor "someone who's written on how passwords should be considered harmful" As an actual security geek, and one who has written on how to choose good passwords, I can assure you your worries are completely unfounded, and campaigning against 2fa is stupid at best
- stephenr 3y ago
  > there's plenty of contrived scenarios Well at least you used the right word, even if you didn't intend that meaning. If your OSS project has meaningful users, and a bus factor of one, it's already under those same risks every day you wake up, but it has the added risk of a malicious actor taking control of your account. > I assume you didn't mean this comment to sound so dismissive, but that's definitely how it reads. Feels very much like your omitted preamble is "just do what GH tells you and don't complain". I mean, I am pretty dismissive of anyone making such a fuss about 2FA. It's not hard to use, and the benefits far outweigh any slight inconvenience. As I said previously, the target audience for GitHub needs to use Git on a regular basis, which is at least several orders of magnitude more complex than entering an OTP occasionally when you login via the web.

So enable 2fa. What's the problem here?

johngladtj 3y ago

I don't like 2fa and don't want to use it.

warrenm 3y ago
Guess you're allowed to not like something ...but not wanting to use something that demonstrably makes you more secure (and is practically cost-free) does not make you look good

bsder 3y ago

Because it's not about 2FA. It will almost certainly be some shitty "We'll SMS your phone" thing in order to get your phone number. And this will enable attacks from my phone that weren't there before. Which actually makes me less secure. It also means that Apple or Google can screw me on Github because they can lock me out of my phone.

jcotton42 3y ago
Not only does GitHub not require SMS for 2FA, they discourage it https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication#configuring-two-factor-authentication-using-text-messages https://docs.github.com/en/authentication/securing-your-acco...
- bsder 3y ago
  A TOTP phone app is the same problem as SMS--my phone is the authenticator. It also provides a bunch of attack vectors like DDoSing my authenticator in order to get me to accidentally approve something. And if my phone battery is dead, I can't log in. And if my phone is stolen, I'm screwed. None of these things improve MY security experience.
  - russelg 3y ago
    The main issue with SMS TOTP seems to be that phone numbers can be trivially stolen via social engineering, or less trivially via direct cell attacks. A TOTP app is effectively immune to both of these attacks. All your concerns are still quite valid however.

countWSS 3y ago

Its a huge change and increased burden to ordinary users and "ordering users to use 2FA or else" is not the tone i'd expect from website that thrive on voluntary participation, suddenly dictating that i could only login with specific setup from specific devices.

stephenr 3y ago
By that logic, they should remove passwords too and just work on the honour system. Seriously though, if using a TOTP generator or physical security key is a "burden" for someone, I really doubt they're the target audience for GitHub. The benefits of 2FA are well known, and even if you have to enter the code manually (ie no browser integration) it's still arguably several orders of magnitude simpler in concept than most git operations.
- lesserknowndan 3y ago
  Everything is fine until you realise the person that had 2FA for your organisation’s github admin account left the company six months ago and has deleted their 2FA key. Also phones don’t seem to think it’s important to backup 2FA secrets so when you move devices you’re out of luck.
  - warrenm 3y ago
    > Everything is fine until you realise the person that had 2FA for your organisation’s github admin account left the company six months ago and has deleted their 2FA key. What "organization" only has one person with access to the repositories? These hypotheticals become goofier with each iteration
    - lesserknowndan 3y ago
      Access to the Owner privilege is very different to having access to repositories. Many small organisations may only have one person with an Owner account for the very reason that they don’t _need_ to have multiple people with access to that account as you share out access to repositories to team members that have less privileged accounts. It is much “goofier” to assume that every organisation using Github has two people that have been granted an “Owner” level account.

grayhatter 3y ago

As a security geek, and someone who's written on how passwords should be considered harmful. Github is wrong here. If I'm not willing to participate in this security "upgrade", it will not meaningful increase my security. In fact there's plenty of contrived scenarios in where this will decrease security. Say I run a FOSS project and leave my 2fa at home when I leave for some vacation? And in that same time I get a report about a security bug. If I cant login to fix or even remove a binary. My users will be at risk! you'd better hope it's a short vacation. Also, as an existing user of 2fa on GH, GH's implemention can get fucked! It auto submits 2fa otps for you. I've been locked out of my account for HOURS, multiple times because I'll fat finger one extra key, or the wrong number without realizing it, only to have GH "helpfully" submit the wrong number, i wouldn't have, as the last chance before a lockout timer. > what's the problem here It's not anyone else responsibility to make security decisions for me. And if I wont play along with GH 2fa security rules, GH doesn't gain any security benefit themselves. Which means this new requirement can *only* make things worse. That's the problem. Also, I assume you didn't mean this comment to sound so dismissive, but that's definitely how it reads. Feels very much like your omitted preamble is "just do what GH tells you and don't complain".

warrenm 3y ago
>As a security geek, and someone who's written on how passwords should be considered harmful. Github is wrong here. If I'm not willing to participate in this security "upgrade", it will not meaningful increase my security. You must neither be a "security geek" nor "someone who's written on how passwords should be considered harmful" As an actual security geek, and one who has written on how to choose good passwords, I can assure you your worries are completely unfounded, and campaigning against 2fa is stupid at best
stephenr 3y ago
> there's plenty of contrived scenarios Well at least you used the right word, even if you didn't intend that meaning. If your OSS project has meaningful users, and a bus factor of one, it's already under those same risks every day you wake up, but it has the added risk of a malicious actor taking control of your account. > I assume you didn't mean this comment to sound so dismissive, but that's definitely how it reads. Feels very much like your omitted preamble is "just do what GH tells you and don't complain". I mean, I am pretty dismissive of anyone making such a fuss about 2FA. It's not hard to use, and the benefits far outweigh any slight inconvenience. As I said previously, the target audience for GitHub needs to use Git on a regular basis, which is at least several orders of magnitude more complex than entering an OTP occasionally when you login via the web.