6 ms·

We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra ef

We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle. And in more serious services, like banking... since there is no such thing about 100% security (and in particular 2FA is far from it, e.g. if your phone is stolen with the banking app open, you're screwed), actually the most important thing is that the bank responds and can refund the money if fraud is committed, which it inevitably will for some percentage of unlucky customers. I view 2FA as a way to pass responsability to the customer ("we have very secure systems, so if someone transferred $X out of your account it's surely your fault"). Personally, I feel safer with less security and the bank worrying about fraud than the other way around, so I don't think they're protecting me when they implement this kind of stuff.

Shank 3y ago
Just turn on Passkeys on GitHub, then you don't need 2FA/TOTP. It's also faster.
- mminer237 3y ago
  My password manager autofilling will always be faster than any other option, especially one that requires me to pull out my phone, navigate to my authenticator app, switch to your app (which will only become more time-consuming as more sites require it), then type in the code by hand. The only thing that can compete with password managers on user experience is just actually remembering they're logged in instead of pointlessly logging them out every single day for no reason.
  - mimsee 3y ago
    1Password supports Passkeys, not sure for others. But it's one click on the login page and you're in.
  - jeroenhd 3y ago
    Passkeys work without a phone, or a second device. Windows Hello/TouchID will verify you almost instantly. There are also browser extensions you can use, like 1Password or Bitwarden, to do the passkey flow for you if your device or OS lacks quick authentication options.
  - samcat116 3y ago
    > My password manager autofilling will always be faster than any other option Passkeys will be faster.
- whartung 3y ago
  I don't see how Passkeys eliminates the need for 2FA. Seems to me, and I may not understand it, but it seems to me that Passkeys are more of a way to eliminate having to constantly re-enter you password, but do not eliminate passwords. For example, if I set up a Passkey, that's bound to a specific machine/browser/phones/whatever. But if I log in from another device, there are no Passkeys, so I just need to use my password. If my lose my machine/browser/phone, I'm in the same boat -- new device, and I need to login. Thus the password. I don't use any syncing system, I'm not on iCloud, or use apps, or anything like that, so there's no mechanic for distribution of passkeys. Plus that wouldn't work if I wanted to log from my friends laptop, or something like that. Am I mistaken in how this works? How does enabling Passkeys eliminate 2FA? My issues with 2FA aren't so much the 2FA part (yea, it's a pain in the neck, "one more step", etc., but, it is what it is). My issue is that if my 2FA is lost, and my recovery codes are lost, I'm toast. There's no other way to recover. No other mechanic, at least for Github.
  - _cenw 3y ago
    > I don't use any syncing system, I'm not on iCloud, or use apps, or anything like that, so there's no mechanic for distribution of passkeys. Plus that wouldn't work if I wanted to log from my friends laptop, or something like that. iOS and Android can also just keep local Passkeys where you scan a QR code, though of course if you don't backup anything anywhere you will always have a redundancy problem with any 2FA mechanism. Passkeys are supposed to not be a single authenticator either, so you can enroll another Phone or a Yubikey (or also your local TPM, binding to your user account, for convenience), but not all services support that in practice.
whartung 3y ago
Github 2FA is made extra fun because they only offer a single mechanic of replacing it (that I know of), and that's using the recovery codes. So, they forced me to use 2FA, and I dutifully printed out the recovery codes (don't write down your passwords, that's bad practice, but here's 20 recovery codes that stand between you and losing your account forever, so you know, manage that somehow). When I bought a new iPhone, apparently none of my stored information got copied over. The apps did, but none of the information for those apps (for example, the TOTP info maintained by the authenticator I used). So, I went to log in to Github, opened up my authenticator app, and it was blank. Thankfully I had the codes...back at home, in a drawer, guarded by a cat, so I wasn't completely doomed, but it ruined the day to be sure until I could get home and recover it and recalibrate my TOTP app. Oh, guess who has a photo of their recovery codes on their phone now?
- ta1243 3y ago
  TOTP backups from phones is a major issue, from what I can tell you simply can't do it.
  - smallpipe 3y ago
    With a yubikey everything is stored on the key and the phone is just a terminal, so it travels between phones. Now if you lose the key that's another issue :)
    - ta1243 3y ago
      Sure, so same problem. Less likely your yubikey will be stolen I guess, but less convenient too (something else to carry)
      - deleted 3y ago
        [deleted]
      - tnbp 3y ago
        But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed. Also, your Yubikey is probably less likely to be stolen or break, but I figure it's much easier to lose it, which is why you might want to have two, just in case. And that's where it gets really inconvenient.
PurpleRamen 3y ago
> Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? Because your hobby-project can emerge to be the backbone of someone's multibillion dollar-business, or a small gear in a million other projects, and you will get targeted for a supply-chain-attack.
- bigstrat2003 3y ago
  So implement those tighter security controls when they make sense. Don't force them on everyone when only a small fraction of cases are worthwhile.
- massysett 3y ago
  You are right. However this cost should really be imposed on the multi-billion-dollar business and not on the author of the hobby app.
  - PurpleRamen 3y ago
    How should that work? Nobody knows who is using which part from which repo. And it's not just about big business. There are all kind of small communities and little apps, extensions, etc. with some small communities. Most of them don't even make money, but are juicy targets for some small fast money. Forcing everyone to raise their security and gain awareness about those things is a huge win for everyone, and only a little problem for the individual user. And it seems to be only a phase anyway, as most people & services are moving to more comfortable solutions over time.
    - simoncion 3y ago
      > How should that work? By the users of the software I publish noticing the license that states that while I hope this software is useful to them, it is provided with `"NO WARRANTY, NOT EVEN FOR FITNESS OF PURPOSE" and planning accordingly. If you're an entity that wants to ensure that software you use from a source that you have approximately zero power over (and has explicitly provided NO warranty for that software) is and continues to be fit for purpose, you're going to have to inspect that software at a point in time, determine if it is fit for your purposes, and carefully inspect every future version of that software that you're considering using. There really are no shortcuts. Requiring one to drink a Confirmation Can to log in doesn't change the math here.
deleted 3y ago
[deleted]
nlawalker 3y ago
> Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? Same reason Microsoft forces Windows updates so aggressively - because if some kind of security breach makes the news, even if it's clearly due to poor user choices (poor password choices and/or security; repeatedly opting out of critical security updates), it's always the vendor/service provider that looks bad.
deleted 3y ago
[deleted]
pmontra 3y ago
I stopped logging in into GitHub since then. My customers are using Bitbucket right now so the only reasons to log into GitHub would be to search the code of some project or opening an issue to one. Luckily I can search issues without being logged in and about opening issues, I feel a little bad but I don't open them anymore. It was my way to contribute to open source, it's gone because of too much friction.
- MrMan 3y ago
  [dead]
- hot_gril 3y ago
  Making login harder is Microsoft's classic thing. At least they didn't do it like Minecraft, locking out tons of pre-existing users.
devnullbrain 3y ago
Github is an unfortunate choice of example because the replies have fixated on it but there are a large number of sites that impose security cargo-culting to secure things that just don't need it. e.g. Why do I need to make an account with a password to pay a bill?
watwut 3y ago
Personally, I think that they simply don't like to be go to free storage for all of our personal or hobby or open spurce projects. This way, free users are less likely to use github while paying corporations will stay.
qhwudbebd 3y ago
I spent a little time trying to decide whether GitHub's 2fa was genuinely an extra factor whose compromise (with an uncompromised password) wouldn't weaken security vs a situation where it hadn't been set up at all. In that case, presumably I could embed the totp key in a bookmarklet in the conveniently-sized 'public bio' field on my profile so I can complete it on whatever device I happen to be using, and effectively opt out? But I'm really not convinced they aren't fuckwits and wouldn't treat the 'second factor' as an authoritative single factor in some circumstances (e.g. password reset) which wouldn't be unauthenticated if 2fa wasn't set up. I'm also not convinced one can even contact anyone at GitHub clueful enough to answer that question authoritatively nowadays rather than reading off a script.
- Al-Khwarizmi 3y ago
  That's another pet peeve of mine with 2FA, which I didn't mention to avoid posting a wall of text: in many cases (no idea if GitHub in particular is one of them), the second factor totally dominates (allowing you to recover the first factor or logging in without it) so it effectively is 1FA, where the factor is almost always your phone. Lose your phone, and you're screwed.
rurp 3y ago
2FA can also be a way to get more private data, like phone numbers, out of users; which will be used for things having nothing to do with security or helping the user. Facebook did exactly this and I'm sure other companies have as well. 2FA increases risk of the account owner losing access to their account. There are a huge amount of posts online from people livid about getting locked out of their account because of some mundane reason like their phone breaking. That risk rarely seems to be considered by the crowd pushing 2FA everywhere and anywhere, probably because it happens most often to non-techies. Things that seem easy or obvious to folks working in tech are often a huge hurdle for regular users, who make up the majority of users for many products. Many tech companies could do a much better job of considering the needs of their users, rather than building what the devs and product managers personally think is cool.
tim333 3y ago
>if your phone is stolen with the banking app open, you're screwed With my one not really as you still have to enter a simple password to do anything - six letters, no dumb requirements for capitals and odd symbols. There is something to be said for simple passwords that people can actually remember. They don't work in situations where hackers can try loads of attempts electronically but where you have to type them if they are quite good really.
sandmn 3y ago
While 2FA is everywhere but whether it should be enabled by default or not is very subjective. Not that long time ago there was a discussion about 23andMe data leak through user accounts that reused emails/passwords on some other compromised site. I was surprised how many people here argued that 23andMe should be responsible for this data breach because it's common knowledge that people reuse passwords all the time and yet 23ndMe didn't make 2FA mandatory until after the leak. Personally I prefer to have a choice on whether 2FA should be enabled or not but I also understand companies that don't want to be blamed for something that is entirely user's fault so it's much easier for them to make 2FA mandatory, even though with phone apps it's not really 2FA since it's the same device.

Shank 3y ago

Just turn on Passkeys on GitHub, then you don't need 2FA/TOTP. It's also faster.

mminer237 3y ago
My password manager autofilling will always be faster than any other option, especially one that requires me to pull out my phone, navigate to my authenticator app, switch to your app (which will only become more time-consuming as more sites require it), then type in the code by hand. The only thing that can compete with password managers on user experience is just actually remembering they're logged in instead of pointlessly logging them out every single day for no reason.
- mimsee 3y ago
  1Password supports Passkeys, not sure for others. But it's one click on the login page and you're in.
- jeroenhd 3y ago
  Passkeys work without a phone, or a second device. Windows Hello/TouchID will verify you almost instantly. There are also browser extensions you can use, like 1Password or Bitwarden, to do the passkey flow for you if your device or OS lacks quick authentication options.
- samcat116 3y ago
  > My password manager autofilling will always be faster than any other option Passkeys will be faster.
whartung 3y ago
I don't see how Passkeys eliminates the need for 2FA. Seems to me, and I may not understand it, but it seems to me that Passkeys are more of a way to eliminate having to constantly re-enter you password, but do not eliminate passwords. For example, if I set up a Passkey, that's bound to a specific machine/browser/phones/whatever. But if I log in from another device, there are no Passkeys, so I just need to use my password. If my lose my machine/browser/phone, I'm in the same boat -- new device, and I need to login. Thus the password. I don't use any syncing system, I'm not on iCloud, or use apps, or anything like that, so there's no mechanic for distribution of passkeys. Plus that wouldn't work if I wanted to log from my friends laptop, or something like that. Am I mistaken in how this works? How does enabling Passkeys eliminate 2FA? My issues with 2FA aren't so much the 2FA part (yea, it's a pain in the neck, "one more step", etc., but, it is what it is). My issue is that if my 2FA is lost, and my recovery codes are lost, I'm toast. There's no other way to recover. No other mechanic, at least for Github.
- _cenw 3y ago
  > I don't use any syncing system, I'm not on iCloud, or use apps, or anything like that, so there's no mechanic for distribution of passkeys. Plus that wouldn't work if I wanted to log from my friends laptop, or something like that. iOS and Android can also just keep local Passkeys where you scan a QR code, though of course if you don't backup anything anywhere you will always have a redundancy problem with any 2FA mechanism. Passkeys are supposed to not be a single authenticator either, so you can enroll another Phone or a Yubikey (or also your local TPM, binding to your user account, for convenience), but not all services support that in practice.

whartung 3y ago

Github 2FA is made extra fun because they only offer a single mechanic of replacing it (that I know of), and that's using the recovery codes. So, they forced me to use 2FA, and I dutifully printed out the recovery codes (don't write down your passwords, that's bad practice, but here's 20 recovery codes that stand between you and losing your account forever, so you know, manage that somehow). When I bought a new iPhone, apparently none of my stored information got copied over. The apps did, but none of the information for those apps (for example, the TOTP info maintained by the authenticator I used). So, I went to log in to Github, opened up my authenticator app, and it was blank. Thankfully I had the codes...back at home, in a drawer, guarded by a cat, so I wasn't completely doomed, but it ruined the day to be sure until I could get home and recover it and recalibrate my TOTP app. Oh, guess who has a photo of their recovery codes on their phone now?

ta1243 3y ago
TOTP backups from phones is a major issue, from what I can tell you simply can't do it.
- smallpipe 3y ago
  With a yubikey everything is stored on the key and the phone is just a terminal, so it travels between phones. Now if you lose the key that's another issue :)
  - ta1243 3y ago
    Sure, so same problem. Less likely your yubikey will be stolen I guess, but less convenient too (something else to carry)
    - deleted 3y ago
      [deleted]
    - tnbp 3y ago
      But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed. Also, your Yubikey is probably less likely to be stolen or break, but I figure it's much easier to lose it, which is why you might want to have two, just in case. And that's where it gets really inconvenient.

PurpleRamen 3y ago

> Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? Because your hobby-project can emerge to be the backbone of someone's multibillion dollar-business, or a small gear in a million other projects, and you will get targeted for a supply-chain-attack.

bigstrat2003 3y ago
So implement those tighter security controls when they make sense. Don't force them on everyone when only a small fraction of cases are worthwhile.
massysett 3y ago
You are right. However this cost should really be imposed on the multi-billion-dollar business and not on the author of the hobby app.
- PurpleRamen 3y ago
  How should that work? Nobody knows who is using which part from which repo. And it's not just about big business. There are all kind of small communities and little apps, extensions, etc. with some small communities. Most of them don't even make money, but are juicy targets for some small fast money. Forcing everyone to raise their security and gain awareness about those things is a huge win for everyone, and only a little problem for the individual user. And it seems to be only a phase anyway, as most people & services are moving to more comfortable solutions over time.
  - simoncion 3y ago
    > How should that work? By the users of the software I publish noticing the license that states that while I hope this software is useful to them, it is provided with `"NO WARRANTY, NOT EVEN FOR FITNESS OF PURPOSE" and planning accordingly. If you're an entity that wants to ensure that software you use from a source that you have approximately zero power over (and has explicitly provided NO warranty for that software) is and continues to be fit for purpose, you're going to have to inspect that software at a point in time, determine if it is fit for your purposes, and carefully inspect every future version of that software that you're considering using. There really are no shortcuts. Requiring one to drink a Confirmation Can to log in doesn't change the math here.

deleted 3y ago

[deleted]

nlawalker 3y ago

> Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? Same reason Microsoft forces Windows updates so aggressively - because if some kind of security breach makes the news, even if it's clearly due to poor user choices (poor password choices and/or security; repeatedly opting out of critical security updates), it's always the vendor/service provider that looks bad.

deleted 3y ago

[deleted]

pmontra 3y ago

I stopped logging in into GitHub since then. My customers are using Bitbucket right now so the only reasons to log into GitHub would be to search the code of some project or opening an issue to one. Luckily I can search issues without being logged in and about opening issues, I feel a little bad but I don't open them anymore. It was my way to contribute to open source, it's gone because of too much friction.

MrMan 3y ago
[dead]
hot_gril 3y ago
Making login harder is Microsoft's classic thing. At least they didn't do it like Minecraft, locking out tons of pre-existing users.

devnullbrain 3y ago

Github is an unfortunate choice of example because the replies have fixated on it but there are a large number of sites that impose security cargo-culting to secure things that just don't need it. e.g. Why do I need to make an account with a password to pay a bill?

watwut 3y ago

Personally, I think that they simply don't like to be go to free storage for all of our personal or hobby or open spurce projects. This way, free users are less likely to use github while paying corporations will stay.

qhwudbebd 3y ago

I spent a little time trying to decide whether GitHub's 2fa was genuinely an extra factor whose compromise (with an uncompromised password) wouldn't weaken security vs a situation where it hadn't been set up at all. In that case, presumably I could embed the totp key in a bookmarklet in the conveniently-sized 'public bio' field on my profile so I can complete it on whatever device I happen to be using, and effectively opt out? But I'm really not convinced they aren't fuckwits and wouldn't treat the 'second factor' as an authoritative single factor in some circumstances (e.g. password reset) which wouldn't be unauthenticated if 2fa wasn't set up. I'm also not convinced one can even contact anyone at GitHub clueful enough to answer that question authoritatively nowadays rather than reading off a script.

Al-Khwarizmi 3y ago
That's another pet peeve of mine with 2FA, which I didn't mention to avoid posting a wall of text: in many cases (no idea if GitHub in particular is one of them), the second factor totally dominates (allowing you to recover the first factor or logging in without it) so it effectively is 1FA, where the factor is almost always your phone. Lose your phone, and you're screwed.

rurp 3y ago

2FA can also be a way to get more private data, like phone numbers, out of users; which will be used for things having nothing to do with security or helping the user. Facebook did exactly this and I'm sure other companies have as well. 2FA increases risk of the account owner losing access to their account. There are a huge amount of posts online from people livid about getting locked out of their account because of some mundane reason like their phone breaking. That risk rarely seems to be considered by the crowd pushing 2FA everywhere and anywhere, probably because it happens most often to non-techies. Things that seem easy or obvious to folks working in tech are often a huge hurdle for regular users, who make up the majority of users for many products. Many tech companies could do a much better job of considering the needs of their users, rather than building what the devs and product managers personally think is cool.

tim333 3y ago

>if your phone is stolen with the banking app open, you're screwed With my one not really as you still have to enter a simple password to do anything - six letters, no dumb requirements for capitals and odd symbols. There is something to be said for simple passwords that people can actually remember. They don't work in situations where hackers can try loads of attempts electronically but where you have to type them if they are quite good really.

sandmn 3y ago

While 2FA is everywhere but whether it should be enabled by default or not is very subjective. Not that long time ago there was a discussion about 23andMe data leak through user accounts that reused emails/passwords on some other compromised site. I was surprised how many people here argued that 23andMe should be responsible for this data breach because it's common knowledge that people reuse passwords all the time and yet 23ndMe didn't make 2FA mandatory until after the leak. Personally I prefer to have a choice on whether 2FA should be enabled or not but I also understand companies that don't want to be blamed for something that is entirely user's fault so it's much easier for them to make 2FA mandatory, even though with phone apps it's not really 2FA since it's the same device.