News for hackers. Stuff that matters.

A comment on GitHub will require 2FA by the end of 2023. Parent comment

Re:GitHub will require 2FA by the end of 2023 by jwilk on Thursday May 05, 2022 @02:07PM (#31276674)
Recovery codes are generated by the server, so:

• there's no temptation for the user to use them on another website, where they could leak

• the server can ensure they are high-entropy (although AFAICS GitHub's recovery codes are only 40-bit…)

Moreover, if someone takes over your e-mail account, they can reset your password; but they can't reset the recovery codes.

[ Parent | on HN ]
Re:GitHub will require 2FA by the end of 2023 by skrebbel on Thursday May 05, 2022 @03:48PM (#31277683)
If this is all though, then couldn't we just use username+password auth but have the server generate the password? Why at the phone to the loop at all?
[ Parent | on HN ]
Re:GitHub will require 2FA by the end of 2023 by dane-pgp on Thursday May 05, 2022 @04:25PM (#31278000)
Are you saying that iPhone-maker Apple and Android-maker Google (and TPM-mandator Microsoft) might not be able to imagine a future where the whole world isn't dependent on them for identity?
[ Parent | on HN ]
Re:GitHub will require 2FA by the end of 2023 by skrebbel on Friday May 06, 2022 @01:26AM (#31281615)
No, I am not suggesting that 2FA is a secret ploy by BigCos to make them needlessly important. It's perfectly possible to log into services without using your Google/Apple/Microsoft identity, even if they insist on 2FA. Use the email and SMS, Luke!
[ Parent | on HN ]