> GitHub’s internal research shows that only around 16.5 percent of active users (roughly one in six) currently enable the enhanced security measures on their accounts

I don't use Github, but it seems a little excessive. Does this apply to private repositories as well?

I quite agree. Not every GitHub account is mission critical. Some are created only to submit homework or to segregate one's online identity. Adding mandatory 2FA is an additional burden, especially if Microsoft ever decide to enforce the use of mobile numbers.

It's more shocking that you can even create accounts at all without MFA in this day and age, especially something like GitHub.

Not everything needs to be treated as a mission-critical account of the highest importance. I recently had an app for a home appliance ask me to set up 2FA. Yeah, sure, because my IoT dishwasher or plant monitor is such a critical respurce worth protecting.

If someone really knows what they are doing, let them not use 2FA. GitHub is different from Facebook, in that we're supposed to know what we're doing with technology. Let hacking sort out the stragglers.

"knows what they're doing" doesn't have anything to do with it. If you don't have MFA, your account is going to get compromised by one of the billion bots trying to get it. Tell me you don't understand basic security without telling me you don't understand basic security.

That's not how it works. I have strong randomly-generated passwords for most sites, and store them in a password manager that I only ever load on ~3 devices that I completely trust and own. Short of typing the password in on a compromised machine, a "forgot password" reset (via the website or customer support), or being incautious enough to log in via a phishing form, I see no way that my accounts can be compromised.

And as I said, for some accounts, there are no consequences if they are compromised.

I have a few accounts I view as valuable enough to enable 2FA on.

This change in Github will just lead to me either being more annoyed or storing the TOTP generator code in my password manager.

A better link: https://github.blog/2022-05-04-software-security-starts-with...

But I don't want it. I use a password manager with a strong password protected with 2FA, my GitHub password is unique. Now I will have to put a 2FA key in it... Let me login with an ssh key at this point, it won't change anything for me.

The fact that these types of threads are filled with inaccurate FUD bordering on lies makes me even more convinced that practices like this are indeed necessary.

Just like with Google, yes, you can setup 2FA on GitHub without giving them a phone number. It's very, very easy.

More discussion here:

https://news.ycombinator.com/item?id=31273229

Interesting timing given the Heroku breach. Any correlation?

In other words, github wants your phone number too. They even bothered to come up with a cute reason: increasing security in the age of supply chain attacks.

GitHub does not have my phone number (although it's trivial to obtain). I use their TOPT 2FA.

Afaik github doesn't force you to reveal your phone number, you can setup OTP or U2F token instead.

While this is certainly true in many places where SMS 2FA is being required, as others have noted you can just use TOTP oh github, see oathtool.

You can use a security key or TOTP app instead of providing your phone number.

no, fuck this and fuck you