News for hackers. Stuff that matters.
Re:GitHub will require 2FA by the end of 2023 by kmlx on Thursday May 05, 2022 @01:03PM (#31275890)
isn't it just better to use an app such as 1Password that can keep all your one-time passwords?
Re:GitHub will require 2FA by the end of 2023 by photon-torpedo on Thursday May 05, 2022 @01:09PM (#31275964)
Then if the password manager is compromised, the second factor wouldn't add any protection over just a password.

Then again, people that use password managers at all usually have stronger passwords and less password reuse, so it can be an acceptable tradeoff.

Re:GitHub will require 2FA by the end of 2023 by tarentel on Thursday May 05, 2022 @01:22PM (#31276128)
In my case it wouldn't anyway. Almost all of my 2FA is tied to my password manager as well. I am sure I am not alone in this. It is kind of scary to think about though.
Re:GitHub will require 2FA by the end of 2023 by tuckerman on Thursday May 05, 2022 @01:40PM (#31276349)
I do the same but, for me, the threat of my password manager being compromised is much much smaller than the threat me not enabling 2FA out of laziness or the concern I might lose my 2FA codes. I keep my main email codes out of the password vault and that is enough to calm my nerves.

Not everyone has the same risk profile/tolerance, but I just wanted to say that I don't think anyone should feel bad about doing the best they can, even if that stops short of the absolute best.

Re:GitHub will require 2FA by the end of 2023 by tomrod on Thursday May 05, 2022 @01:16PM (#31276057)
Aye, but it assumes the company isn't keep the password in plain text.