How is everyone handling the 2FA requirement for GitHub? (docs.github.com)

submitted 5 months ago* (last edited 5 months ago) by StorageB@lemmy.one to c/opensource@lemmy.ml

126 comments fedilink hide all child comments

Just wondering what people are using to meet the 2FA requirement GitHub has been rolling out. I don't love the idea of having an authenticator app installed on my phone just to log into GitHub. And really don't want to give them my phone number just to log in.

Last year, we announced our commitment to require all developers who contribute code on GitHub.com to enable two-factor authentication (2FA)...

you are viewing a single comment's thread
view the rest of the comments

[-] Reddfugee42@lemmy.world 59 points 5 months ago

If you're not already using 2fa everywhere you can, you're already doing it wrong.

[+] ssm@lemmy.sdf.org -6 points 5 months ago

2FA is for people who don't know how to use randomized passwords for every site

[-] Reddfugee42@lemmy.world 5 points 5 months ago

Brilliant. Until that website's unsalted pw database is downloaded through a SQL injection.

Use both. You're not smarter than security professionals.

[-] kevincox@lemmy.ml 1 points 5 months ago

Salt doesn't matter if your password is unique.
If they can download data via SQL injection having them log in probably doesn't matter that much.
If they can dump your password/hash they can likely also dump the TOTP secret.
A lot of website security expert attention is focused on raising the minimum security level. If you are using randomly generated passwords + auto-fill you are likely above their main target audience.

So yes, it is slightly better, but in practice that difference probably doesn't matter. If you use U2F then you may have a meaningful security increase but IMHO U2F is not practical to use on every site due to basically being impossible to manage credentials.

So yes, it is better. But for me using random passwords and a password manager it isn't worth the bother.