Today I had a big ugly banner on top of Github: Use 2FA or your account will be disabled in January.
I don't want to use 2FA. It may be better security but I don't care, I don't want to use it for anything except my bank accounts.
I have my password manager and can login with 1 click to all my sites. 2FA is always a pain in the ass and always extra effort on something my password manager already protects me from.
What's a good alternative that does not require 2FA to sign in and use it?
GitHub is doing something the world needs: putting better security on a huge chunk of the open source software that is shared and relied upon by literally all of humanity.
Any repo, anywhere, has the chance to become a part of the open source ecosystem. Strongly authenticated developer accounts on those repos is critical for everyone's security. It sucks that we are here, but here we are. Password managers are almost enough to save us, but not quite.
I think it is fair to complain about particular factors of 2FA (e.g. TOTP or Yubikey or iPhone Passkey or SMS or whatever). And it's fair to complain that the session timeout on a strongly authenticated persistent session cookie should be user-managed (30 days? no problem! 90 days? I trust my device enough for an API key, why not a cookie?).
And all your command-line stuff is already API key-based on GitHub...
But good 2FA offers real security against a lot of threats. I hope more people embrace it.
https://media.tenor.com/vJLaS5etgRwAAAAd/shit-wow.gif
It would be like if Reddit started requiring 2FA to 'protect my account'.
If I was using GH in a professional capacity, this would be different. But I guess I resent that I don't get to make the choice. Security Daddy at GitHub thinks I'm too stupid.
Deleted Comment
Losing your authenticator and recovery codes means the account is lost permanently. This feels like a bigger threat to my account security than not having 2FA. Not saying it _is_ a bigger threat, but it feels like a bigger threat.
You know a much easier and way more probable way to lose an account? If the password gets leaked/intercepted and there's no other security check.
Back on topic though: I run a local Forgejo/Gitea instance which doesn't have 2FA (or the maturity of the bigger forges if we are being honest). Could be worth a look if you are up to self hosting it.
Limitless private git repositories.
Also, git has a built in web server.
https://git-scm.com/docs/gitweb
So I think there are a few potential issues with this argument based on assumptions you're making. I'd argue this isn't entirely true because:
1. Many password managers allow you to manually copy the password into your clipboard, which mean you could paste it somewhere that's unsafe / untrusted. Someone could then use this password to authenticate as you. Many sites disallow token reuse, so once used if you accidentally pasted that somewhere as well an attacker couldn't reuse the token.
2. Similarly, if someone has managed to exfiltrate login details you provide without being able to also obtain the session cookie sent back, and the site enforces one time use of MFA tokens, then the MFA token can also avoid a replay attack of your login details.
I'll admit the second one may be a bit contrived, because if they can exfiltrate login details it seems likely they could also just obtain the session cookie. But if said cookie is tied to a certain IP address, then that cookie is useless to them and they wouldn't be able to replay the credentials.
I use passkeys in 1Password for GitHub access