As far as complying with 2FA requirements without these, if TOTP is an option, one way is to use Authy with desktop client. It's free.

How secure it is I can't really say. But it will allow you to access services requiring TOTP without a cellphone or usb dongle.

https://authy.com/blog/introducing-authy-for-your-personal-c...

If you're as crazy as I am, it looks like oauthtool+gnupg2 can do TOTP via the command-line on Linux as well. I think it's just another function that my homeserver will take over (or maybe a container). At least I can easily integrate this new info into my backup system, unlike apps on my phone...

There is also an Authy linux app, but, sure, open source command-line sounds great.

you can get a tiny one and keep it plugged into your laptop

Okay so which one do I buy and how do I use it with ssh. The documentation is not specific.

The github.com documentation pages I read on this topic yesterday said the MFA requirement was for web sign-on and https GIT repo URLs. It explicitly said that SSH-based git repo access would not be affected. Has anyone seen contradictory statements published by github?

Edit to add: I mean SSH git access using a keypair registered with your account. (I don't know if there is some legacy option to use SSH with passwords, which I imagine would be discontinued if not already.)

yubikey 5 nano, get two. i use it w/ ssh. took a little googling to integrate the gpg authentications key w/ ssh. instead of using ssh-agent, you'd use gpg-agent to manage the keys.

there are other integrations, for example, i can also unlock my mac w/ the yubikey.

On gnome on fedora at least, I can have my gpg automatically unlock when I login to the desktop.

I already have two steps on GitHub with the authy app but I don't get it. Why is it not good enough to send an email with a code when signing in without a cookie for people who don't want to opt in to two steps?

The way I see it my authy is a vulnerability because if someone were to guess my authy phone number, they could technically grab all of my TOTP.

I don't get this spoon feeding. I mean I would sign up to two steps where I can but something doesn't feel right about the lack of choice.

i hate checking email or looking at my phone for two step auth. either choice requires me to access another system. It requires far fewer steps to just tap the button on the side of the yubikey.

It's pricey but looks like it won't be too warty, thanks.

https://forums.freebsd.org/threads/yubikey-5-nfc-not-working...

> Okay so which one do I buy and how do I use it with ssh. The documentation is not specific.

Oh crap, I was thinking this doesn't affect me because I already have two factors authentication but yes if I need to fish out my phone every time I need to git something (I use sash, not tokens) that requires authentication, I will definitely minimize what I do on GitHub.