Re:Tell HN: GitHub locked me out for not using 2FA
by TillE on Friday September 06, 2024 @09:08AM
(#41465839)
GitHub prompts you to save backup codes when you set up 2FA, and every so often when you log in. I don't think that's a terrible job, it's pretty much the standard.
They also nudge you to set up multiple 2FA methods. I have the app, a passkey, etc.
Re:Tell HN: GitHub locked me out for not using 2FA
by ebichu63 on Friday September 06, 2024 @10:03AM
(#41466323)
I don't bother much with the special back-up codes (although I do store them just in case). I just make sure I have the TOTP plaintext shared secrets stored on multiple devices.
Re:Tell HN: GitHub locked me out for not using 2FA
by nathanaldensr on Friday September 06, 2024 @09:07AM
(#41465831)
One of the reasons I use Microsoft Authenticator instead of others is it allows me to back up the configuration to the Microsoft cloud. I've already followed the restore process several times over the course of replacing phones and it works well.
Re:Tell HN: GitHub locked me out for not using 2FA
by miohtama on Friday September 06, 2024 @09:25AM
(#41465979)
Authy backups work as well, have been using half a decade now.
Re:Tell HN: GitHub locked me out for not using 2FA
by elliotwu on Friday September 06, 2024 @05:36PM
(#41469899)
Problem with Authy is you can't export your seeds externally, which sets you up for failure if Authy decides to turn into the next Raivo.
There is an unofficial method by using devtools on the desktop app, but it's been EOL for months and it may soon stop working completely.
Nearly all resistance to 2FA is because of fear of losing access to the 2FA device. I believe it's a well-earned resistance, because they've done a terrible job of explaining that there are alternatives in that case, such as special codes that you can write down and put in a safe.