7 ms·
Tell HN: GitHub locked me out for not using 2FA
Effectively 2fa is now mandatory for all accounts, not only commiters. If you didn't configure 2fa yet, the time has come to do it.
PS: I didn't see this news, so posting it, sorry if I'm slow
- dmichulke 2y agoFor the record, I don't like it either. I use generated passwords and I check the URL before c+p'ing my password, what do I gain with it?
- rzwitserloot 2y agoA lot less than what your average 'I just reuse the same password on a million sites' or your average 'my password is "iloveyou8", you see, the 8 makes it secure!"' user gains from 2FA. But it's not nothing. If you get phished and enter both your password and TFA in a scam site, they can log in as you, but they will not be able to log in as you later on, and (presumably, if github configured their stuff correctly) them _changing_ your settings (either updating TFA or removing the requirement to use TFA) is either not possible without _another_ attempt to phish you, or will result in you at least knowing e.g. because you receive an email from them. In contrast if they have your password and that's all that is needed to log in, they can now log in as you for however long until you change your password, and you won't know. Similar benefits apply if your hardware is compromised due to a keylogger. Or, much more plausible, some tool is watching your clipboard. Which _will_ see the password, but _will not_ see your TFA unless you're also copy pasting that on the same device. If the device that stores your generated passwords is itself compromised and you store your 2FA stuff elsewhere (a good general principle!) then it helps _quite a lot_. Trying to 'fake it' without 2FA is quite complicated; you'd need to store half of your password on one password vault and the other half on another and combine them by hand. It depends a bit on your theory about how security is best done. if you ascribe to the swiss cheese model (where you layer quite a few slices of swiss cheese on top of each other with the aim that whilst each slice has holes, the stack does not have any holes), then these are quite a few added slices.
- dmichulke 2y agoThanks. I like the resistance against reading your clipboard, and I assume this is possible as a non-root application on Linux such as a steam game that I started. Phishing awareness I have with the exception of dumb moments. TFA on two devices I have as well but most my techyish colleagues actually don't, especially not for stuff that's easily done on the phone such as banking/crypto :-/
- beretguy 2y ago> If you didn't configure 2fa yet, the time has come to do it. The time has come to ditch GitHub. A while ago I barely managed to create an account using an email alias that worked (instead of providing my actual email). Within minutes GitHub deleted my account for some reason. I suspect it’s because I used email alias, but I really have no idea why.
- MeetingsBrowser 2y agoWhy is it time to ditch GitHub? Are you morally opposed to 2FA or using a valid email?
- dakiol 2y agoI don’t have important stuff on GitHub, so for me the additional effort of 2FA is not worth it. I’ll ditch GitHub.
- MeetingsBrowser 2y agoIs it really ditching it if you weren’t using it to start with, lol. I don’t like that Spotify asked me for a valid credit card, so I’m cancelling my 30 day free trial. I don’t listen to much music anyway.
- GoblinSlayer 2y agoWell, I guess they don't lock it immediately and you can make it a little easier with keepass.
- teeray 2y ago2FA is superfluous if you’re using high entropy passwords stored in a password manager that incorporates phishing protection mechanisms (e.g. refusing to fill / warning when domains do not match).
- JohnMakin 2y agoUntil the password manager is hacked/leaked. See: lastpass breach. Protecting the security of multiple devices is much easier than maintaining, rotating, and securing cryptographically secure passwords. Ideally, as with most things in security, do both. There’s no real reason to eschew 2FA other than “I hate typing in a code sometimes.”
- BonusPlay 2y agoGitHub is slowly rolling out feature over moe than a year [1], which will have positive impact on overall IT security. Spending 1 minute setting up 2FA is really not a big deal. [1] https://github.blog/news-insights/product-news/raising-the-bar-for-software-security-github-2fa-begins-march-13/ https://github.blog/news-insights/product-news/raising-the-b...
- w0m 2y agoI wonder how much of the negative connotation in ~every GitHub thread comes from the MS buyout vs the actual topic under discussion. Do people really dislike 2FA on something as important as source hosting?
- arp242 2y ago> something as important as source hosting? But it's not important for a lot of people. Lots of people just create the occasional issue or some such. Almost no one is a maintainer of something important. And overall it's just a hassle that adds zero security for me; I just have the tokens in the password manager next to the passwords (where else do I store it? I just have my laptop). It's something that should be the user choice, based on how important the account is, personal factors, etc.
- blueflow 2y ago2FA is a bigger problem to me than Microsoft. I'm not having electronics on me most of the time. If i have to log in to Github from somewhere else, i call my landline and have SO read the 2FA code to me. But since this is cumbersome i try to get my stuff done without the Github login.
- gbraad 2y agoAnd while you are at it; set up passkeys. You can thank me later.
- gbraad 2y agoseriously people? sarcasm. though passkeys are handy. I expect them to become the next 'recommended' practice when this is more widely adopted.
- whitehexagon 2y agoI used to enjoy sharing some code for the benefit of the community, although less and less since SAS business models, and now AI training. Mandatory 2fa feels like a step towards 'MS GitHub Certified Developer & Contributor' program. How else do you 'secure the supply chain' without having identified and accountable developers.
- latexr 2y agoThis feels like a slippery slope fallacy. I don’t trust Microsoft and don’t think they have user’s best interests at heart, but 2FA is generally accepted as a positive thing industry-wide. They’re far from the only ones to require it. See for example PyPI. https://blog.pypi.org/posts/2024-01-01-2fa-enforced/ https://blog.pypi.org/posts/2024-01-01-2fa-enforced/ npm is another one, but because it’s owned by GitHub (and thus Microsoft) we can leave it out of the argument.
- eesmith 2y agoWhy is it a fallacy? I stopped distributing on PyPI before the switch to 2FA because I could see it also going the "Certified Developer & Contributor" route, which is what often happens with centralized systems. PyPI's later switch to 2FA confirmed my belief that they going further along that slope. Centralized systems are hard to manage. We've seen how Anaconda and readthedocs have switched their business models to get more funding. PyPI uses a lot of bandwidth, and needs people to manage all of the attacks and abuse. And you know who has money? Big businesses who want someone else to manage their supply chain. And you know who has the time to help manage these systems? People working for big businesses. PyPI was able to require a change to 2FA in part because there aren't effective alternatives, nor the easy ability to migrate from one to another. Those who don't want to be part of the "industry" have a high switching cost. Also, what does "industry-wide" mean? I distribute packages (source and binary wheels) on my own server. None of my commercial customers have ever even asked about 2FA. And if I am in the same industry, I can assure you I have never placed that requirement on my suppliers.
- MeetingsBrowser 2y ago
- deleted 2y ago[deleted]
- _joel 2y agoedit, I can't read.. Gitlab's currently on fire, don't worry about it. https://status.gitlab.com/ https://status.gitlab.com/ Also, really, nowadays everything should be MFA or SSO backed with MFA.
- tboyd47 2y agoBecause the web is so much more secure now that MFA is used everywhere?
- s_dev 2y agoI will say a status page that gives out red flags at least makes me trust it more. The AWS status page might as well be static until there is massive outrage on the internet that shows it is completely down, then a single green light will turn yellow or red after HR or Marketing have confirmed that there is no hiding the outage.
- stefanos82 2y agoGitHub != Gitlab
- _joel 2y agoderp, I need my eye checking!