8 ms·

Why opposed to MFA? Source code is one of the most important assets in our realm.

by illusive4080 3y ago

userbinator 3y ago
Freedom is far more important.
- illusive4080 3y ago
  But you can use any totp authenticator. The protocol is free and open.
  - userbinator 3y ago
    It's more to make the point that "no means no." An act of protest. (I have written a TOTP implementation myself. I do not have a GH account, and likely never will.)
    - Dylan16807 3y ago
      It's ridiculous to say "no means no" about not wanting to use a password to get an account, right? What makes TOTP different from a password in terms of use or refusal?
      - ndriscoll 3y ago
        Browsers don't save the TOTP seed and auto fill it for you for one, making it much less user friendly than a password in practice. The main problem I have with MFA is that it gets used too frequently for things that don't need that much protection, which from my perspective is basically anything other than making a transfer or trade in my bank/brokerage. Just user-hostile requiring of manual action, including finding my phone that I don't always keep on me. It's also often used as a way to justify collecting a phone number, which I wouldn't even have if not for MFA.
        saagarjha 3y ago
        Mine does. Yours doesn't?
        jeromegv 3y ago
        We are talking of non-SMS MFA
- creatonez 3y ago
  Should you have the freedom to put in a blank password, too?
  - voidz 3y ago
    My password is a single 'a'. Nobody will ever guess that one.
- Freedom2 3y ago
  They have the freedom to request whatever authentication method they want.
hobobaggins 3y ago
Most people will have to sync their passwords (generally strong and unique, given that it's for github) to the same device where their MFA token is stored, rendering it (almost) completely moot, but at a significantly higher risk of permanent access loss (depending on what they do with the reset codes, which, if compromised, would also make MFA moot.) (a cookie theft makes it all moot as well.) The worse part is that people think they're more protected, when they're really not.
- Dylan16807 3y ago
  Bringing everyone up to the level of "strong and unique password" sounds like a huge benefit. Even if your "generally" is true, which I doubt, that leaves a lot of gaps.
- account42 3y ago
  Doesn't help that a lot of companies still just allow anyone with access to the phone number to gain access to the account (via customer support or automated SMS-based account recovery).
loeg 3y ago
It's inconvenient, SMS 2FA is arguably security theater, and redundant with a real password manager. Hopefully Passkeys kills 2FA for most services.
- Hawxy 3y ago
  FYI github already supports using passkeys as a combined login/2FA source. I haven't used my 2FA codes for a while now.
  - deleted 3y ago
    [deleted]
- illusive4080 3y ago
  SMS 2FA is the devil. It’s the reason I haven’t swapped phone numbers even though I get 10-15 spam texts a day. The spam blocking apps don’t help and intrude on my privacy.
LtWorf 3y ago
My source code is important to others but not to me. I have backups. but 2FA is annoying to me. It's very easy to permanently lose accounts when 2FA is in use. If I lose my device my account is gone for good. Tokens from github never expire, and can do everything via API without ever touching 2FA, so it's not that secure.
- Brian_K_White 3y ago
  "If I lose my device my account is gone for good." Incorrect, unless you choose not to record your seeds anywhere else, which is not a 2fa problem. 2fa is in the end nothing more than a 2nd password that just isn't sent over the wire when used. You can store a totp seed exactly the same as a password, in any form you want, anywhere you want, and use on a brand new device at any time.
  - LtWorf 3y ago
    > Incorrect, unless you choose not to record your seeds anywhere else, which is not a 2fa problem. You know google authenticator app introduced a backup feature less than 1 year ago right? You know phones break all the time right?
    - Brian_K_White 3y ago
      You know google authenticator doesn't matter right? You know you could always copy your totp seeds since day one regardless of which auth app or it's features or limits right? You know that a broken device does not matter at all, because you have other copies of your seeds just like the passwords, right? When I said they are just another password, I was neither lying nor in error. I presume you can think of all the infinite ways that you would keep copies of a password so that when your phone or laptop with keepassxc on it breaks, you still have other copies you can use. Well when I say just like a password, that's what I mean. It's just another secret you can keep anywhere, copy 50 times in different password managers or encrypted files, print on paper and stick in a safe, whatever. Even if some particular auth app does not provide any sort of manual export function (I think google auth did have an export function even before the recent cloud backup, but let's assume it didn't), you can still just save the original number the first time you get it from a qr code or a link. You just had to know that that's what those qr codes are doing. They aren't single-use, they are nothing more than a random secret which you can keep andbcopy and re-use forever, exactly the same as a password. You can copy that number into any password manager or plain file or whatever you want just like a password, and then use it to set up the same totp on 20 different apps on 20 different devices, all working at the same time, all generating valid totp codes at the same time, destroy them all, buy a new phone, retrieve any one of your backup keepass files or printouts, and enter them into a fresh app on a fresh phone and get all your totp fully working again. You are no more locked out than by having to reinstall a password manager app and access some copy of your password db to regain the ordinary passwords. The only difference from a password is, the secret is not sent over the wire when you use it, something derived from it is. Google authenticators particular built in cloud copy, or lack of, doesn't matter at all, and frankly I would not actually use that particular feature or that particular app. There are lots of totp apps on all platforms and they all work the same way, you enter the secret give it a name like your bank or whatever, select which algorithm (it's always the default, you never have to select anything) and instantly the app starts generating valid totp codes for that account the same as your lost device. Aside from saving the actual seed, let's say you don't have the original qr code any more (you didn't print it or screenshot it or right-click save image?) there is yet another emergency recovery which is the 10 or 12 recovery passwords that every site gives you when you first set up totp. You were told to keep those. They are special single-use passwords that get you in without totp, but each one can only be used once. So, you are a complete space case and somehow don't have any other copiesbof your seeds in any form, including not even simple printouts or screenshots of the original qr code, STILL no problem. You just burn one of your 12 single-use emergency codes, log in, disable and re-enable totp on that site, get a new qr code and a new set of emergency codes. Your old totp seed and old emergency codes no longer work so thow those out. This time, not only keep the emergency codes, also keep the qr code, or more practical, just keep the seed value in the qr code. It's right there in the url in the qr code. Sometimes they even display the seed value itself in plain text so that you can cut & paste it somewhere, like into a field in keepass etc. In fact keepass apps on all platforms also will not only store the seed value but display the current totp for it just like a totp app does. But a totp app is a more convenient. And for proper security, you technically shouldn't store both the password and the totp seed for an account in the same place, so that if someone gains access to one, they don't gain access to both. That's inconvenient but has to be said just for full correctness. I think most sites do a completely terrible job of conveying just what totp is when you're setting it up. They tell you to scan a qr code but they kind of hide what that actually is. They DO all explain about the emergency codes but really those emergency codes are kind of stupid. If you can preserve a copy of the emergency codes, then you can just as easily preserve a copy of the seed value itself exactly the same way, and then, what's the point of a hanful of single-use emergency passwords when you can just have your normal fully functional totp seed? Maybe one use for the emergency passwords is you could give them to different loved ones instead of your actual seed value? Anyway if they just explained how totp basically works, and told you to keep your seed value instead of some weird emergency passwords, you wouldn't be screwed when a device breaks, and you would know it and not be worried about it. Now, if, because of that crappy way sites obscure the process, you currently don't have your seeds in any re-usable form, and also don't have your emergency codes, well then you will be F'd when your phone breaks. But that is fixable. Right now while it works you can log in to each totp-enabled account, and disable & reenable totp to generate new seeds, and take copies of them this time. Set them up on some other device just to see that they work. Then you will no longer have to worry about that.
jjav 3y ago
> Why opposed to MFA? Source code is one of the most important assets in our realm. Because if you don't use weak passwords MFA doesn't add value. I do recommend MFA for most people because for most people their password is the name of their dog (which I can look up on social media) followed by "1!" to satisfy the silly number and special character rules. So yes please use MFA. But if your (like my) passwords are 128+bits out of /dev/random, MFA isn't adding value.
- samatman 3y ago
  The slogan is "something you know and something you have", right? I don't have strong opinions about making it mandatory, but I turned on 2FA for all accounts of importance years ago. I use a password manager, which means everything I "know" could conceivably get popped with one exploit. It's not that much friction to pull out (or find) my phone and authenticate. It only gets annoying when I switch phones, but I have a habit of only doing that every four years or so. You sound like you know what you're doing, that's fine, but I don't think it's true that MFA doesn't add security on average.
  - jjav 3y ago
    > It only gets annoying when I switch phones Right. I don't ever want to tie login to a phone because phones are pretty disposable. > I don't think it's true that MFA doesn't add security on average You're right! On average it's better, because most people have bad password and/or reuse them in more than one place. So yes MFA is better. But if your password is already impossible to guess (as 128+ random bits are) then tacking on a few more bytes of entropy (the TOTP seed) doesn't do much.
    - satokema 3y ago
      Those few bits are the difference between a keylogged password holder waltzing in and an automated monitor noticing that someone is failing the token check and locking the account before any damage occurs.
      - 3y ago
deleted 3y ago
[deleted]

Why opposed to MFA? Source code is one of the most important assets in our realm.

userbinator 3y ago

Freedom is far more important.

illusive4080 3y ago
But you can use any totp authenticator. The protocol is free and open.
- userbinator 3y ago
  It's more to make the point that "no means no." An act of protest. (I have written a TOTP implementation myself. I do not have a GH account, and likely never will.)
  - Dylan16807 3y ago
    It's ridiculous to say "no means no" about not wanting to use a password to get an account, right? What makes TOTP different from a password in terms of use or refusal?
    - ndriscoll 3y ago
      Browsers don't save the TOTP seed and auto fill it for you for one, making it much less user friendly than a password in practice. The main problem I have with MFA is that it gets used too frequently for things that don't need that much protection, which from my perspective is basically anything other than making a transfer or trade in my bank/brokerage. Just user-hostile requiring of manual action, including finding my phone that I don't always keep on me. It's also often used as a way to justify collecting a phone number, which I wouldn't even have if not for MFA.
      - saagarjha 3y ago
        Mine does. Yours doesn't?
      - jeromegv 3y ago
        We are talking of non-SMS MFA
creatonez 3y ago
Should you have the freedom to put in a blank password, too?
- voidz 3y ago
  My password is a single 'a'. Nobody will ever guess that one.
Freedom2 3y ago
They have the freedom to request whatever authentication method they want.

hobobaggins 3y ago

Most people will have to sync their passwords (generally strong and unique, given that it's for github) to the same device where their MFA token is stored, rendering it (almost) completely moot, but at a significantly higher risk of permanent access loss (depending on what they do with the reset codes, which, if compromised, would also make MFA moot.) (a cookie theft makes it all moot as well.) The worse part is that people think they're more protected, when they're really not.

Dylan16807 3y ago
Bringing everyone up to the level of "strong and unique password" sounds like a huge benefit. Even if your "generally" is true, which I doubt, that leaves a lot of gaps.
account42 3y ago
Doesn't help that a lot of companies still just allow anyone with access to the phone number to gain access to the account (via customer support or automated SMS-based account recovery).

loeg 3y ago

It's inconvenient, SMS 2FA is arguably security theater, and redundant with a real password manager. Hopefully Passkeys kills 2FA for most services.

Hawxy 3y ago
FYI github already supports using passkeys as a combined login/2FA source. I haven't used my 2FA codes for a while now.
- deleted 3y ago
  [deleted]
illusive4080 3y ago
SMS 2FA is the devil. It’s the reason I haven’t swapped phone numbers even though I get 10-15 spam texts a day. The spam blocking apps don’t help and intrude on my privacy.

LtWorf 3y ago

My source code is important to others but not to me. I have backups. but 2FA is annoying to me. It's very easy to permanently lose accounts when 2FA is in use. If I lose my device my account is gone for good. Tokens from github never expire, and can do everything via API without ever touching 2FA, so it's not that secure.

Brian_K_White 3y ago
"If I lose my device my account is gone for good." Incorrect, unless you choose not to record your seeds anywhere else, which is not a 2fa problem. 2fa is in the end nothing more than a 2nd password that just isn't sent over the wire when used. You can store a totp seed exactly the same as a password, in any form you want, anywhere you want, and use on a brand new device at any time.
- LtWorf 3y ago
  > Incorrect, unless you choose not to record your seeds anywhere else, which is not a 2fa problem. You know google authenticator app introduced a backup feature less than 1 year ago right? You know phones break all the time right?
  - Brian_K_White 3y ago
    You know google authenticator doesn't matter right? You know you could always copy your totp seeds since day one regardless of which auth app or it's features or limits right? You know that a broken device does not matter at all, because you have other copies of your seeds just like the passwords, right? When I said they are just another password, I was neither lying nor in error. I presume you can think of all the infinite ways that you would keep copies of a password so that when your phone or laptop with keepassxc on it breaks, you still have other copies you can use. Well when I say just like a password, that's what I mean. It's just another secret you can keep anywhere, copy 50 times in different password managers or encrypted files, print on paper and stick in a safe, whatever. Even if some particular auth app does not provide any sort of manual export function (I think google auth did have an export function even before the recent cloud backup, but let's assume it didn't), you can still just save the original number the first time you get it from a qr code or a link. You just had to know that that's what those qr codes are doing. They aren't single-use, they are nothing more than a random secret which you can keep andbcopy and re-use forever, exactly the same as a password. You can copy that number into any password manager or plain file or whatever you want just like a password, and then use it to set up the same totp on 20 different apps on 20 different devices, all working at the same time, all generating valid totp codes at the same time, destroy them all, buy a new phone, retrieve any one of your backup keepass files or printouts, and enter them into a fresh app on a fresh phone and get all your totp fully working again. You are no more locked out than by having to reinstall a password manager app and access some copy of your password db to regain the ordinary passwords. The only difference from a password is, the secret is not sent over the wire when you use it, something derived from it is. Google authenticators particular built in cloud copy, or lack of, doesn't matter at all, and frankly I would not actually use that particular feature or that particular app. There are lots of totp apps on all platforms and they all work the same way, you enter the secret give it a name like your bank or whatever, select which algorithm (it's always the default, you never have to select anything) and instantly the app starts generating valid totp codes for that account the same as your lost device. Aside from saving the actual seed, let's say you don't have the original qr code any more (you didn't print it or screenshot it or right-click save image?) there is yet another emergency recovery which is the 10 or 12 recovery passwords that every site gives you when you first set up totp. You were told to keep those. They are special single-use passwords that get you in without totp, but each one can only be used once. So, you are a complete space case and somehow don't have any other copiesbof your seeds in any form, including not even simple printouts or screenshots of the original qr code, STILL no problem. You just burn one of your 12 single-use emergency codes, log in, disable and re-enable totp on that site, get a new qr code and a new set of emergency codes. Your old totp seed and old emergency codes no longer work so thow those out. This time, not only keep the emergency codes, also keep the qr code, or more practical, just keep the seed value in the qr code. It's right there in the url in the qr code. Sometimes they even display the seed value itself in plain text so that you can cut & paste it somewhere, like into a field in keepass etc. In fact keepass apps on all platforms also will not only store the seed value but display the current totp for it just like a totp app does. But a totp app is a more convenient. And for proper security, you technically shouldn't store both the password and the totp seed for an account in the same place, so that if someone gains access to one, they don't gain access to both. That's inconvenient but has to be said just for full correctness. I think most sites do a completely terrible job of conveying just what totp is when you're setting it up. They tell you to scan a qr code but they kind of hide what that actually is. They DO all explain about the emergency codes but really those emergency codes are kind of stupid. If you can preserve a copy of the emergency codes, then you can just as easily preserve a copy of the seed value itself exactly the same way, and then, what's the point of a hanful of single-use emergency passwords when you can just have your normal fully functional totp seed? Maybe one use for the emergency passwords is you could give them to different loved ones instead of your actual seed value? Anyway if they just explained how totp basically works, and told you to keep your seed value instead of some weird emergency passwords, you wouldn't be screwed when a device breaks, and you would know it and not be worried about it. Now, if, because of that crappy way sites obscure the process, you currently don't have your seeds in any re-usable form, and also don't have your emergency codes, well then you will be F'd when your phone breaks. But that is fixable. Right now while it works you can log in to each totp-enabled account, and disable & reenable totp to generate new seeds, and take copies of them this time. Set them up on some other device just to see that they work. Then you will no longer have to worry about that.

jjav 3y ago

> Why opposed to MFA? Source code is one of the most important assets in our realm. Because if you don't use weak passwords MFA doesn't add value. I do recommend MFA for most people because for most people their password is the name of their dog (which I can look up on social media) followed by "1!" to satisfy the silly number and special character rules. So yes please use MFA. But if your (like my) passwords are 128+bits out of /dev/random, MFA isn't adding value.

samatman 3y ago
The slogan is "something you know and something you have", right? I don't have strong opinions about making it mandatory, but I turned on 2FA for all accounts of importance years ago. I use a password manager, which means everything I "know" could conceivably get popped with one exploit. It's not that much friction to pull out (or find) my phone and authenticate. It only gets annoying when I switch phones, but I have a habit of only doing that every four years or so. You sound like you know what you're doing, that's fine, but I don't think it's true that MFA doesn't add security on average.
- jjav 3y ago
  > It only gets annoying when I switch phones Right. I don't ever want to tie login to a phone because phones are pretty disposable. > I don't think it's true that MFA doesn't add security on average You're right! On average it's better, because most people have bad password and/or reuse them in more than one place. So yes MFA is better. But if your password is already impossible to guess (as 128+ random bits are) then tacking on a few more bytes of entropy (the TOTP seed) doesn't do much.
  - satokema 3y ago
    Those few bits are the difference between a keylogged password holder waltzing in and an automated monitor noticing that someone is failing the token check and locking the account before any damage occurs.
    - 3y ago

deleted 3y ago

[deleted]