50
submitted 1 year ago* (last edited 1 year ago) by StorageB@lemmy.one to c/opensource@lemmy.ml

Just wondering what people are using to meet the 2FA requirement GitHub has been rolling out. I don't love the idea of having an authenticator app installed on my phone just to log into GitHub. And really don't want to give them my phone number just to log in.

Last year, we announced our commitment to require all developers who contribute code on GitHub.com to enable two-factor authentication (2FA)...

you are viewing a single comment's thread
view the rest of the comments
[-] Reddfugee42@lemmy.world 5 points 1 year ago

Brilliant. Until that website's unsalted pw database is downloaded through a SQL injection.

Use both. You're not smarter than security professionals.

[-] kevincox@lemmy.ml 1 points 1 year ago
  1. Salt doesn't matter if your password is unique.
  2. If they can download data via SQL injection having them log in probably doesn't matter that much.
  3. If they can dump your password/hash they can likely also dump the TOTP secret.
  4. A lot of website security expert attention is focused on raising the minimum security level. If you are using randomly generated passwords + auto-fill you are likely above their main target audience.

So yes, it is slightly better, but in practice that difference probably doesn't matter. If you use U2F then you may have a meaningful security increase but IMHO U2F is not practical to use on every site due to basically being impossible to manage credentials.

So yes, it is better. But for me using random passwords and a password manager it isn't worth the bother.

[-] Reddfugee42@lemmy.world 0 points 1 year ago
this post was submitted on 05 Jun 2024
50 points (79.1% liked)

Open Source

37447 readers
950 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS