Well at least you used the right word, even if you didn't intend that meaning.
If your OSS project has meaningful users, and a bus factor of one, it's already under those same risks every day you wake up, but it has the added risk of a malicious actor taking control of your account.
> I assume you didn't mean this comment to sound so dismissive, but that's definitely how it reads. Feels very much like your omitted preamble is "just do what GH tells you and don't complain".
I mean, I am pretty dismissive of anyone making such a fuss about 2FA. It's not hard to use, and the benefits far outweigh any slight inconvenience.
As I said previously, the target audience for GitHub needs to use Git on a regular basis, which is at least several orders of magnitude more complex than entering an OTP occasionally when you login via the web.
I used contrived, because I meant contrived. They're invented.... until they happen.
While I'm pretty sure this will conflict with your world view. You don't understand the world in which I live better than me, and you don't understand my threat model better than I do. You'd convince a lot more people that you're right, if you even pretended like you believe that instead of acting like you're hot shit.
> If your OSS project has meaningful users, and a bus factor of one, it's already under those same risks every day you wake up, but it has the added risk of a malicious actor taking control of your account.
Passwords used correctly aren't less secure than passwords + 2fa. But they do increase the chance of lockout. And given human nature, if used incorrectly they might decrease it.
> I mean, I am pretty dismissive of anyone making such a fuss about 2FA. It's not hard to use, and the benefits far outweigh any slight inconvenience.
Well at least you're being honest about not caring about others. That's not nothing. But my advice to you, if you care about security, more than you care about being right, is to be less dismissive of people who think differently from you, maybe then you'll have a chance at convincing them of anything. Instead of what you're actually doing, which is trying to look cool on the Internet.
> and the benefits far outweigh any slight inconvenience ... the target audience for GitHub needs to use Git on a regular basis, which is at least several orders of magnitude more complex than entering an OTP occasionally when you login via the web.
to you... the benefit, inconvenient trade off is worth it to you... there are more scenarios than you can imagine. And I'd also argue you'd become better if you tried to fairly consider some of them, instead of being a douche. But you do make a point, it is more common that people who use gh more, are the most common users. It's not a good point, and it's what's known as a dick move, to everyone else that uses github slightly differently, but to hell with people different from you, right?
sigh
Well at least we're agreed your entire argument is based on made up theoretical scenarios, rather than the real world, where people's accounts are breached because of poor password security, literally on a daily basis.
> Passwords used correctly aren't less secure than passwords + 2fa.
What was that about acting like you're hot shit? There is essentially zero way for you to know that passwords are being "used correctly", because "used correctly" includes how they are stored and transmitted. You have no view into how the remote side stores or transmits passwords though. For all we know (yes this is a hyperbolic theoretical scenario), GitHub stores all passwords in plain text. Or md5'd, or some other equally laughable scenario. Or perhaps they log passwords during authentication. Or perhaps there's an unencrypted path between a load balancer and a backend application server, which is open to packet sniffing by peers in a datacenter, or any number of other issues that have shown to be real-world points of weakness to a password.
A big chunk of the benefit of TOTP based 2FA is that it greatly reduces the risk of replay style attacks. If you get the OTP I send (through logs or packet sniffing or whatever) it holds no long-term risk.
> Well at least you're being honest about not caring about others.
Straw man much? I didn't say I don't care about others. I'm very comfortable with the level of help/advice/expertise I offer to people who ask for it.
Nowhere in any comment I've seen on this post, has anyone asked for help or advice. A number of people have made ridiculously misleading, uninformed or just outright false statements, with absolute confidence. Hence why I said (in another comment, but still a reply to you):
> I'm blaming humans for wilful ignorance and insisting that there is no solution to problems they haven't tried to solve.
> there are more scenarios than you can imagine.
I'm sure there is probably some scenario where having 2FA enabled is a strictly worse scenario than password security alone.
But you'll want to have a pretty damn strong argument prepared, based on a real-world scenario before you should expect others to listen to what you have to say and take it seriously.
Right now you sound like a kid making up excuses about why they can't eat their vegetables.
(FWIW 2fa can be enabled on any phone now, both with totp and passkeys.)
You must neither be a "security geek" nor "someone who's written on how passwords should be considered harmful"
As an actual security geek, and one who has written on how to choose good passwords, I can assure you your worries are completely unfounded, and campaigning against 2fa is stupid at best
Say I run a FOSS project and leave my 2fa at home when I leave for some vacation? And in that same time I get a report about a security bug. If I cant login to fix or even remove a binary. My users will be at risk! you'd better hope it's a short vacation.
Also, as an existing user of 2fa on GH, GH's implemention can get fucked! It auto submits 2fa otps for you. I've been locked out of my account for HOURS, multiple times because I'll one extra key without realizing it, only to have GH "helpfully" submit the wrong number, i wouldn't have, as the last chance before a lockout timer.
> what's the problem here
It's not anyone else responsibility to make security decisions for me. And if I wont play along with GH 2fa security rules, GH doesn't gain any security benefit themselves. Which means this new requirement can *only* make things worse. That's the problem. Also, I assume you didn't mean this comment to sound so dismissive, but that's definitely how it reads. Feels very much like your omitted preamble is "just do what GH tells you and don't complain".