forced 2FA?!? #78992
Replies: 16 comments 9 replies
-
|
WHY, that annoying and useless 2fa forced? Who want to hack - will hack accounts and this freak-show-security-uber-measures will not stop 'em. They just smile and say "we'll enter through another open door". Why do you make suffer innocent users with this circus measures? Its not funny. Stop it. Please. |
Beta Was this translation helpful? Give feedback.
-
|
Just give us a choice: to use, or not, be more polite and tolerate. |
Beta Was this translation helpful? Give feedback.
-
|
Try google voice :) |
Beta Was this translation helpful? Give feedback.
-
|
The moment Github tells me that I'm no longer allowed to access my data because of 2FA is the moment I hold my middle finger high and set my focus to Codeberg and Sourceforge. I got my stuff migrated there and strongly recommend others to do the same if they value whatever freedom they have left before their accounts are locked. It's 2 days left for me. |
Beta Was this translation helpful? Give feedback.
-
|
I'm quitting Github because of this. F M$ |
Beta Was this translation helpful? Give feedback.
-
|
I don't like the idea of being forced to use 2fa. Any current day "app" is usually not compatible with the Android tablet I have. The alternative is to use some 3rd party OTP system of unknown origins. It doesn't feel like a safe thing to do. I don't know what 3rd party OTP program would be safe to use and not turn out to be one that secretly records information that could be used by someone else to access my account. I think I will need to mark my projects as being in an archive state and move the active repositories to some other site. On the set up page for 2FA one of the alternatives methods for 2fa is to send SMS messages. I don't have a cell phone so that method is useless to me. What about something simple such as SSH keys to access our accounts as are used when pushing code changes? |
Beta Was this translation helpful? Give feedback.
-
|
I agree. This is just more annoying nannyware! My security is my business. GitHub isn't my bank where I'm willing to put up with security hassles due the consequences of a break-in being serious. I'm perfectly fine with the level of security I get with just a username and password. More security isn't worth more inconvenience to me. That should be MY call to make! GitHub, get off your high horse and stop imposing your holier-than-though views on us! |
Beta Was this translation helpful? Give feedback.
-
|
It is worse. It creates a SINGLE POINT OF FAILURE which is an error that even MS makes (did anyone tried to configure Win11 without an Internet connection?). |
Beta Was this translation helpful? Give feedback.
-
|
I would like to opt out of 2FA |
Beta Was this translation helpful? Give feedback.
-
|
I am also inclined to move my classes off of GitHub Classroom to avoid 2FA. I think that the Github general philosophy around 2FA is understandable, all this "securing the supply chain" thing makes sense. Maybe, I dunno. I understand that security software is a hard problem, and socially important, and okay maybe it's the right thing to force in some circumstances, or to very strongly pressure, or something. But my code is all personal, or for giving to my students via Github Classroom. If 2FA creates a single hitch in my teaching, I'm going to stop teaching students to use GitHub, simple as that. And if you force my personal account, I'll migrate that too, I guess. I guess I only teach about 200 students per year, so the impact isn't that large for GitHub. |
Beta Was this translation helpful? Give feedback.
-
|
I disagree on securing the suppl6 chain making sense, it sounds like
corpoeate bs packaged to sound logical by a bunch of marketing people.
Software security comes from testing it, not this imaginary supply chain
idea. People introduce vulnerabilities they are unaware of all the time. It
sounds like an initiative some exec with a fake job came up with.
…On Sun, Jan 21, 2024, 4:48 PM jholman-bcit ***@***.***> wrote:
I am also inclined to move my classes off of GitHub Classroom to avoid 2FA.
I think that the Github general philosophy around 2FA is understandable,
all this "securing the supply chain" thing makes sense. Maybe, I dunno. I
understand that security software is a hard problem, and socially
important, and okay maybe it's the right thing to force in some
circumstances, or to very strongly pressure, or something.
But my code is all personal, or for giving to my students via Github
Classroom. If 2FA creates a single hitch in my teaching, I'm going to stop
teaching students to use GitHub, simple as that. And if you force my
personal account, I'll migrate that too, I guess.
I guess I only teach about 200 students per year, so the impact isn't that
large for GitHub.
—
Reply to this email directly, view it on GitHub
<#78992 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AD2R3QS2H3J4OD7YUPJATMLYPWLK5AVCNFSM6AAAAABATO6R7SVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DEMBSGM2TG>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
Are the people who run github even listening? I cannot find any way to reach them, nor do I see any evidence that they read what's on the community discussions. I just got an email saying you can choose one or more of the following options:
None of those options are acceptable. I do not, and will not, use a smartphone or "mobile device" for several reasons. I only access github (or anything else on the internet) with my desktop PC (or on rare occasion, my laptop), and I use Ubuntu Linux, and I have tried various software titles in the software center for TOTP that don't require a smartphone, and they don't launch. They don't run. I also will not use any Google or MS software, nor will I buy anything. I will accept github emailing me a one-time-use key to copy and paste into the login, or a landline phone call with such a number. Otherwise I'm done with github. From what I'm reading, it seems like there will be enough other people who also give up github to make those who run github relent and quit requiring this nonsense. Are you listening, github? |
Beta Was this translation helpful? Give feedback.
-
|
There is two things to be secured. For securing commits and releases and supply chain, signed commits and signed releases (which are already possible) is better, instead of having to trust third parties (such as GitHub) to do it for you. The other thing is secure authentication to GitHub itself; for that, X.509 client certificates would be more secure and doesn't need JavaScripts and doesn't need a web browser and has other advantages. Since the private key for the X.509 certificate may be passworded, this means that it already provides a kind of 2FA as well, and is better than using TOTP or other stuff like that. Anyways, when trying to set up 2FA, it seems to get stuck in a infinite loop and won't work!!! |
Beta Was this translation helpful? Give feedback.
-
|
Even though I perfectly understand everyone who is dissatisfied with this innovation, I consider it beneficial for the entire internet at this stage of the network's development. App-based authentication (TOTP) is a simple and quite effective way to cut off the lion's share of unauthorized accesses. The beauty of TOTP lies in the fact that you are not tied to any specific application. I use it with KeePassXC, which has no network access, and everything works perfectly. When I add some new entries, I simply manually back up the password database to external storage, and I also upload additionally encrypted archives to the cloud if I wish. |
Beta Was this translation helpful? Give feedback.
-
|
Totally agree. |
Beta Was this translation helpful? Give feedback.
-
|
While I understand your frustration, GitHub's mandatory 2FA requirement is actually a positive security measure. Here's why and how to work with it: Why GitHub Enforces 2FA:
2FA Methods GitHub Supports:
Working Around Limited Connectivity:
For Developers with Multiple Devices:
The inconvenience is temporary, but the security benefit is permanent. Once set up, you rarely notice it. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I know my opinion matters not to the almighty Micro$oft who now owns Github.
I am still registering a complaint even though it will never make any difference.
I am extremely unhappy that the system now requires 2 factor authentication for my account.
I will never /voluntarily/ use 2FA, but in this case I am given no control over the situation. my only option while still allowing others to share the code bases I've put up here over the last decade+ would be to export all my repositories to a more "freedom" oriented platform. but I'm not aware of one. Gitlab has gone to paid-only access except for viewing some time ago, so they're right out.
My complaint is that nobody should be /forced/ to use 2FA to sign in. it sucks and is not necessary for many of us.
this isn't a spy agency (at least hopefully not), it isn't openly owned by the War Department (renamed as the DoD after WWII) or any other government platform, and I am not employed by a corporation with security protocols. if I was in any of those security-mandated situations I wouldn't have public repositories anyway.
boo, hiss. I gave out my long-standing VOIP SMS number for this unwanted requirement just because I have no choice (I'm certainly not going to allow another third party vendor to "secure" my logins and I am not going to install the github app just to be able to sign in.)
complaint registered, now go ahead and flame me for my distaste of additional security requirements to sign in on my publicly accessible repositories if you see fit... I'll ignore it.
Beta Was this translation helpful? Give feedback.
All reactions