News for hackers. Stuff that matters.

A comment on GitHub will require 2FA by the end of 2023. Parent comment

Re:GitHub will require 2FA by the end of 2023 by joshvm on Thursday May 05, 2022 @02:32PM (#31276926)
Most companies offer manual processes to get round failed 2FA - for example, provide copies of ID, a video chat to confirm, security questions about account details (eg last trips you took), etc. I've had to do this for a couple of services where the process was quite onerous, but that's the point.

Doesn't help if you lose the keys and you're the only one that held them. This happened to me with an SSD that I took out of an old laptop, without realising that But locker stored its key on a chip in the laptop. I didn't even know that I had bitlocker enabled.

But Uber shouldn't have your trip details behind end to end encryption, so they should be able to unlock it.

[ Parent | on HN ]
Re:GitHub will require 2FA by the end of 2023 by pmoriarty on Thursday May 05, 2022 @02:44PM (#31277048)
ID can be easily faked.

Security questions are often shared between services, so someone who's hacked any of the other services could get the answers to these same security questions and then use them to bypass 2FA.

[ Parent | on HN ]