GitHub Supports Web Authentication (WebAuthn) for Security Keys

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by munchbunny on Wednesday August 21, 2019 @04:40PM (#20761530)

In the thread from the Yubico announcement earlier this week, someone brought up the question about why you can't disable SMS for recovery codes (SMS recovery codes, not SMS 2nd factor), since that undermines the security benefit of having your 2nd factor moved entirely to FIDO or OTP. Are there plans to fix that?

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by akerl_ on Wednesday August 21, 2019 @04:47PM (#20761628)

To clarify: you can disable SMS MFA on Github (or never set it up in the first place). Doing so does require setting up TOTP, though you’re able to validate the initial code and then delete your copy of the secret key.

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by munchbunny on Wednesday August 21, 2019 @04:51PM (#20761686)

Sorry, I maybe wasn't clear enough. You can disable SMS MFA (I did), but it didn't sound like you could disable SMS recovery codes, which is the other section further down in the UI for configuring your login setup.

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by akerl_ on Wednesday August 21, 2019 @04:53PM (#20761709)

Ah. Those are disable-able as well: https://imgur.com/a/bLnRuOq

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by munchbunny on Wednesday August 21, 2019 @04:59PM (#20761772)

Awesome! I'm glad I stand corrected.

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by bamboozled on Wednesday August 21, 2019 @05:30PM (#20762033)

Be careful doing this, I’ve had friends who lost their accounts and it was a pretty big loss for them.

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by roca on Wednesday August 21, 2019 @05:42PM (#20762145)

Make sure to print out some backup codes. Also I have two Yubikeys authorized for each of my U2F/Webauthn accounts. Fortunately managing multiple hardware keys is much easier with U2F/Webauthn than with TOTP... at least with Google/AWS/Github, you can add a new key at any time, while with TOTP I had to generate a new TOTP secret and update both keys at the same time.

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by marksomnian on Thursday August 22, 2019 @06:16AM (#20766449)

Yeah, that seems like the best bet - either hardware key or TOTP (because, although hardware keys are better for security, not all users will have one - cf. myself), and then store your backup codes in a password manager.

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by michaelmior on Wednesday August 21, 2019 @05:51PM (#20762226)

I would assume that GitHub support would be willing to provide some out of band authentication to allow someone to recover an account if all other options had been exhausted.

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by Klathmon on Wednesday August 21, 2019 @07:04PM (#20762866)

I personally hope they dont.

Time and time again it's been shown that one of the weakest links for account security is customer support. It's pretty trivial to gather enough information to impersonate someone well enough for most support reps to believe it's actually you.

It's also part of the reason why SMS is so insecure, because legally most phone companies can't not allow you to transfer your number, and the ways they can verify you are you is limited.

If they do allow support account recovery, I hope they allow the ability to disable it for those who don't want the extra attack vectors.

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by jeromegv on Wednesday August 21, 2019 @07:42PM (#20763142)

That's the whole point. We do not want that. This leaves us vulnerable to attacks where they take advantage of the support person naiveness.

[ Parent | on HN ]