Did you really claim 2-factor authentication as your primary differentiation for choosing source control? Really? Not one of the actual uses of the application?

BTW, GitHub does NOT play well with most CI tools. It's memory management is downright abysmal. As someone who understands the deep workings of source control apps, I hate having to constantly work through issues with devs botching their check ins. I never have this with Bitbucket, and it's pretty clear why. It's because BitBucket doesn't use some mishmash of command line and poorly implemented GUIs.

> Did you really claim 2-factor authentication as your primary differentiation for choosing source control? Really?

As someone who used to have keys to a number of security-critical OSS projects, I would never use password-only authentication to protect write access to my repo.

It's not just the chance of someone sneaking in a change and its getting shipped to users -- although that's also awful -- but it's also the chance of someone sneaking in a change that pwns all of your developers (by running a script as part of the build).

And if you're using a private repository and care about keeping your source code secret, then you really, really, really want 2FA.

> And if you're using a private repository and care about keeping your source code secret, then you really, really, really want 2FA.

Um, if I need this, I'm not handing my data to github. Thanks.

Github enterprise edition. Not the cloud service.

So true, actually.

Lack of two factor auth is quickly becoming a dealbreaker for me for everything. It doesn't matter _how_ good your webapp/SaaS works - if it's relying on just a password to secure my PII (or worse, my proprietary sourcecode or intellectual property) it's fundamentally broken, bordering on useless.

How two factor auth will prevent loss of your source code? (assuming your password is unique)

Keyloggers? Social engineering around the password reset function?

I use 2FA on all my personal accounts that support it (Twitter, Github, Gmail, Namecheap, banks).

If a software can log your keypresses, it can probably steal your cookies and log in as you from your machine. Cookies stored by browsers are easily readable by processes running as the same user.

It will help when my unique password get exposed through any of the many likely routes that don't give the attacker complete code execution on the servers - SQLi or using XSS to steal admin tokens for example.

Interesting, sqli that works only for reading encrypted_hash from DB? But since password is unique it cannot be bruteforced even locally.

True - it's the (many many documented[1]) cases where the SQLi grabs the password_cleartext column, not the encrypted_hash one that worry me here.

[1] http://plaintextoffenders.com/