Technology @lemmy.ml Xylight (Photon dev) @lemmy.xylight.dev 1 yr. ago

GitHub to require 2FA on accounts by October 6, 2023

github.blog Raising the bar for software security: GitHub 2FA begins March 13

On March 13, we will officially begin rolling out our initiative to require all developers who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023. Read on to learn about what the process entails and how you can help secure the software sup...

I personally am fine with this.

125

125 comments

Yep, should be standard everywhere
While you are adding this anyway consider using an open source app instead of google auth like aegis. There are many others but I wish I knew about them sooner.
Permanently Deleted
Good, people are fucking stupid and if it effects others it's often better to choose the security for them!
2fa should be mandatory everywhere
Passkeys supported?
2FA is the biggest bane to my productivity in the last 15 years, no part of my work life should require me to pull out my magic distraction device.
No offense to companies but I'm honestly sick of companies forcing 2fa. Every single one seems to have a different shitty way of doing it. Like why on earth do I need two different authenticator apps on my phone (authy&google authenticator)? Some do sms/phone number, but then yell at you and prevent you from doing 2fa if you have a "bad phone number". This happened on discord where I'm locked out of certain servers because I can't do phone verification, and I can't do it because discord doesn't like my phone number. Twitter was the same way for a long while (couldn't do 2fa/phone verification due to them not liking my number).

From the article it sounds like they're doing authenticator app or sms. I'm guessing sms won't work for me, so app it is. I decided to dig to see which authenticator app they use and they list: 1password, authy, lastpass, and microsoft.... no google?

Honestly, even email requirements for accounts is annoying because you know it just ends up spamming you. is the future where we're gonna have to have 30 different authenticator apps on our phone?
I personally am afraid of this. What if something gets botched? I'll be permanently locked out of my account!
this won't stop the myriad of idiots making commits of public/private keys and passwords in plain text to public repositories

You've viewed 125 comments.