Re:GitHub will require 2FA by the end of 2023
by michaelmior on Thursday May 05, 2022 @02:04PM
(#31276638)
This is of course implementation dependent, but ideally a recovery key is single use. You should also be notified by email or some other channel that the recovery key was used. Then you are immediately aware if this use was unauthorized and you can take appropriate action. This type of response is not possible for unauthorized password use.
[ Parent
| on HN ]
Re:GitHub will require 2FA by the end of 2023
by em-bee on Thursday May 05, 2022 @02:09PM
(#31276690)
you can get notifications for logins from a new device. isn't that just as useful?
Re:GitHub will require 2FA by the end of 2023
by michaelmior on Thursday May 05, 2022 @02:52PM
(#31277118)
I think there's at least a couple ways these are different:
1. It's easy to start ignoring such notifications if you regularly log in to new devices (or if logins expire). I don't think this is true to the same degree with notifications of recovery code usage.
2. Devices can potentially be spoofed.