News for hackers. Stuff that matters.

A comment on GitHub will disable non-2FA accounts?. Parent comment

Re:GitHub will disable non-2FA accounts? by jcotton42 on Tuesday August 15, 2023 @06:09PM (#37139921)
Not only does GitHub not require SMS for 2FA, they discourage it https://docs.github.com/en/authentication/securing-your-acco...
[ Parent | on HN ]
Re:GitHub will disable non-2FA accounts? by bsder on Wednesday August 16, 2023 @01:59AM (#37143353)
A TOTP phone app is the same problem as SMS--my phone is the authenticator.

It also provides a bunch of attack vectors like DDoSing my authenticator in order to get me to accidentally approve something.

And if my phone battery is dead, I can't log in.

And if my phone is stolen, I'm screwed.

None of these things improve MY security experience.

[ Parent | on HN ]
Re:GitHub will disable non-2FA accounts? by russelg on Wednesday August 16, 2023 @12:07PM (#37149221)
The main issue with SMS TOTP seems to be that phone numbers can be trivially stolen via social engineering, or less trivially via direct cell attacks. A TOTP app is effectively immune to both of these attacks. All your concerns are still quite valid however.
[ Parent | on HN ]