Just wondering what people are using to meet the 2FA requirement GitHub has been rolling out. I don't love the idea of having an authenticator app installed on my phone just to log into GitHub. And really don't want to give them my phone number just to log in.

Last year, we announced our commitment to require all developers who contribute code on GitHub.com to enable two-factor authentication (2FA)...

you are viewing a single comment's thread
view the rest of the comments

[–] Reddfugee42@lemmy.world 59 points 5 months ago (2 children)

If you're not already using 2fa everywhere you can, you're already doing it wrong.

[+] ssm@lemmy.sdf.org -6 points 5 months ago (3 children)

2FA is for people who don't know how to use randomized passwords for every site

[–] Reddfugee42@lemmy.world 5 points 5 months ago (1 children)

Brilliant. Until that website's unsalted pw database is downloaded through a SQL injection.

Use both. You're not smarter than security professionals.

[–] kevincox@lemmy.ml 1 points 5 months ago (1 children)

Salt doesn't matter if your password is unique.
If they can download data via SQL injection having them log in probably doesn't matter that much.
If they can dump your password/hash they can likely also dump the TOTP secret.
A lot of website security expert attention is focused on raising the minimum security level. If you are using randomly generated passwords + auto-fill you are likely above their main target audience.

So yes, it is slightly better, but in practice that difference probably doesn't matter. If you use U2F then you may have a meaningful security increase but IMHO U2F is not practical to use on every site due to basically being impossible to manage credentials.

So yes, it is better. But for me using random passwords and a password manager it isn't worth the bother.

[–] Reddfugee42@lemmy.world 0 points 5 months ago

Called it

[–] Miaou@jlai.lu 3 points 5 months ago

The day your machine is compromised is also the day ALL your passwords get stolen.