Re:GitHub mirror compromise incident report
by snowwolf on Wednesday July 04, 2018 @03:04PM
(#17458904)
Github allows multiple administrator accounts.
Re:GitHub mirror compromise incident report
by moviuro on Thursday July 05, 2018 @05:39AM
(#17461950)
Backup codes are a thing. https://help.github.com/articles/downloading-your-two-factor...
Re:GitHub mirror compromise incident report
by IThoughtYouGNU on Wednesday July 04, 2018 @08:53PM
(#17460246)
It's very simple to do this on Github.
2FA, by it's nature, is bound to one single software, tool, or piece of hardware[1].
This limits the access of e.g. an administrator-login to one person and her personal phone, only. A bus-factor that is unacceptable to many.
Software like AWS allows more granular set-up, but still complex. Linode, Digital-Ocean and even docker.io, last time I looked, make it impossible to share the admin-account by allowing multiple 2FA devices active on one account simultaneous. And if they did, that would greatly lower the security of that account (still better than no 2fa though)
[1] 2FA, like google authenticator (or one of the much better open source alternatives thereof) make it possible to share a 2fa secret across devices, but that is both insecure and hard.