3 ms·
Tell HN: GitHub is no more usable without mobile devices
Since Microsoft bought Github, I have to use a one-time key every time I log in, which is annoying. But today I received a letter in which they insist that I have the second of two factors from the list:
Security key
GitHub Mobile
Authenticator application (TOTP)
Text messages (SMS)
I don't use smartphones, so all I can do is share my phone number, which will naturally be passed on to spammers. Tell me an alternative to GitHub, please.
- rapnie 3y agoFor reference: https://github.blog/2023-03-09-raising-the-bar-for-software-security-github-2fa-begins-march-13/ https://github.blog/2023-03-09-raising-the-bar-for-software-... > Tell me an alternative to GitHub, please. Codeberg.org or self-hosted Gitea / Forgejo. Or Sourcehut if you prefer that more minimalistic style.
- dave4420 3y agoWhy not use a desktop TOTP app? This is possible using e.g. 1Password, but there must be others you could use as well.
- eimrine 3y agoI visited 1password website and seems like this is not just an app but a paid service which requires some account which means more learning some proprietary software and even more spam in my email. Why there is no option for Github to get rid of any 2-factor for me? I have not any finished project, my name means nothing for the community.
- pjerem 3y agoThere are tons of open source & free local OTP applications.
- coldtea 3y ago>which means more learning some proprietary software and even more spam in my email. Can always quite software and become a farmer or something... People proposed it as a solution to the OTP for "need mobile phone to use GH" thing. It's one solution, there are others. >Why there is no option for Github to get rid of any 2-factor for me? I have not any finished project, my name means nothing for the community. Because they don't make it for you, but for everybody. And security is important for others too. If your account gets pwned, it can be used to spread malware, or to facilitate shady behavior that can't be tracked to the real culprits. If there was such an option, people would disable it without knowing the risks for "convenience", and then cry and blame GH when their accounts are taken.
- fabrixxm 3y agoKeePassXC stores user/password and otp. Not the most secure way to use otp, but surely it's handy.
- PennRobotics 3y agoYou can use TOTP without a phone, like via PyOTP or through some of the password managers (although on Bitwarden it's a paid feature) I moved from GH to GitLab but not for authentication reasons.
- zimpenfish 3y agoI use some Rust with the `otp` crate for a single secret ($WORK Okta) and `mambembe`[1] on my server for the rest of them. [1] https://github.com/jaysonsantos/mambembe https://github.com/jaysonsantos/mambembe
- Supply5411 3y ago>without mobile devices But 50% of the 2FA options you listed do not require a mobile device. Security key and TOTP app. TOTP apps are free. Try authy.
- NoZebra120vClip 3y agoGitHub sent you a letter? What does their letterhead look like? What'd they put for a return address? How much postage was on it? Seriously though, MFA may be annoying, but that's nothing compared to a credential-stuffing hacker taking over your account. Spend a few bucks on a Yubico Yubikey. You'll be glad you did.
- t312227 3y agohello, i'm using hardware security-tokens as my 2nd-factor wherever its possible ... and i'm a big fan of them: they are pretty cheap & i don't need to have a mobile device at hand. last but not least: imho. they are more secure than mobile devices, which are prone to lots of spy-/malware etc. :) just my 0.02€ ps. ah, alternative to github ... selfhosted git!? with some interface if necessary * gitweb - easy, fast, "just enough" for a technical person * cgit - same same * gitea * ...
- mikecoles 3y agoGithub alternatives include Forgejo, Gitlab, and Gitea.