News for hackers. Stuff that matters.

A comment on GitHub will disable non-2FA accounts?. Parent comment

Re:GitHub will disable non-2FA accounts? by bsder on Tuesday August 15, 2023 @05:36PM (#37139576)
Because it's not about 2FA.

It will almost certainly be some shitty "We'll SMS your phone" thing in order to get your phone number.

And this will enable attacks from my phone that weren't there before.

Which actually makes me less secure.

[ Parent | on HN ]
Re:GitHub will disable non-2FA accounts? by jcotton42 on Tuesday August 15, 2023 @06:09PM (#37139921)
Not only does GitHub not require SMS for 2FA, they discourage it https://docs.github.com/en/authentication/securing-your-acco...
[ Parent | on HN ]
Re:GitHub will disable non-2FA accounts? by bsder on Wednesday August 16, 2023 @01:59AM (#37143353)
A TOTP phone app is the same problem as SMS--my phone is the authenticator.

It also provides a bunch of attack vectors like DDoSing my authenticator in order to get me to accidentally approve something.

And if my phone battery is dead, I can't log in.

And if my phone is stolen, I'm screwed.

None of these things improve MY security experience.

[ Parent | on HN ]
Re:GitHub will disable non-2FA accounts? by russelg on Wednesday August 16, 2023 @12:07PM (#37149221)
The main issue with SMS TOTP seems to be that phone numbers can be trivially stolen via social engineering, or less trivially via direct cell attacks. A TOTP app is effectively immune to both of these attacks. All your concerns are still quite valid however.
[ Parent | on HN ]