top | item 31276109

(no title)

mdb31 | 3 years ago

Well, given that Github today doesn't seem to support meaningful 2FA (only TOTP and SMS), wouldn't it be good to fix that issue before starting to talk about requirements like these?

Maybe it's just my account, but I can't currently enroll my hardware token with Github in any way whatsoever.

Sure, they offer some 1.5FA, but why would I bother with that?

discuss

einichi|3 years ago

They let you enroll a hardware token after you enable either a TOTP or SMS 2FA method. No idea why, seems to defeat the point of the additional security that a hardware token offers.

procombo|3 years ago

Authenticator apps, and SMS help them derive you have identity -- which is more secure for them and you. Hardware token via WebAuthn (etc) is only more secure for you.

When they say "for the sake of security" they mean for them too.

There's a reason they want you to verify using one of the first two methods first.

ProZsolt|3 years ago

I use FIDO U2F since 2015.

I got my Yubikey from Github for $5 https://github.blog/2015-10-01-github-supports-universal-2nd...

mdb31|3 years ago

Yet, if you go into the "enable 2FA" settings on Github, you only get the option to enable insecure TOTP or SMS.

Apparently, once you do that, you might be able to add proper authentication. But no word on whether that then replaces the obsolete methods you were forced to configure earlier.

But, yes, right on track to enforce 2FA in 2023, I see...

klaustopher|3 years ago

U2F has been supported for a while: https://docs.github.com/en/authentication/securing-your-acco...

mdb31|3 years ago

Oh, that's lovely UX... "After you configure 2FA, using a time-based one-time password (TOTP) mobile app, or via text message, you can add a security key"

So, after you enable a broken-by-design 1.5FA method, which you don't want, and which will further expose you to account takeovers, you can, possibly configure actual security.

No wonder these guys are raking in the big bucks...

gkbrk|3 years ago

I understand the SMS part, but what makes TOTP a not "meaningful" 2FA?

mdb31|3 years ago

The TOTP "private key" can be easily cloned. Targeted malware, a database compromise at your app provider that you "securely" sync your settings to, or just a few minutes access to your "authentication" device, will do the trick.

drdaeman|3 years ago

This is odd - they sure do support WebAuthn, I've been using a YubiKey for years.