Re:GitHub will require 2FA by the end of 2023
by kmlx on Thursday May 05, 2022 @01:03PM
(#31275890)
isn't it just better to use an app such as 1Password that can keep all your one-time passwords?
[ Parent
| on HN ]
Re:GitHub will require 2FA by the end of 2023
by photon-torpedo on Thursday May 05, 2022 @01:09PM
(#31275964)
Then if the password manager is compromised, the second factor wouldn't add any protection over just a password.
Then again, people that use password managers at all usually have stronger passwords and less password reuse, so it can be an acceptable tradeoff.
Re:GitHub will require 2FA by the end of 2023
by tarentel on Thursday May 05, 2022 @01:22PM
(#31276128)
In my case it wouldn't anyway. Almost all of my 2FA is tied to my password manager as well. I am sure I am not alone in this. It is kind of scary to think about though.
Re:GitHub will require 2FA by the end of 2023
by tuckerman on Thursday May 05, 2022 @01:40PM
(#31276349)
I do the same but, for me, the threat of my password manager being compromised is much much smaller than the threat me not enabling 2FA out of laziness or the concern I might lose my 2FA codes. I keep my main email codes out of the password vault and that is enough to calm my nerves.
Not everyone has the same risk profile/tolerance, but I just wanted to say that I don't think anyone should feel bad about doing the best they can, even if that stops short of the absolute best.