Just wondering what people are using to meet the 2FA requirement GitHub has been rolling out. I don’t love the idea of having an authenticator app installed on my phone just to log into GitHub. And really don’t want to give them my phone number just to log in.
Last year, we announced our commitment to require all developers who contribute code on GitHub.com to enable two-factor authentication (2FA)…
I generate a TOTP with my password manager, it stores all my other login details and keeps it simple.
That seems like it defeats the “2” part of 2FA. If your password manager is compromised the attackers now how complete access.
Technically true.
You are right, having the password in the same vault does mean that if the vault itself is compromised they have both. Guess I could move the TOTP to a separate authenticator app but the only other apps I have a mobile only and there are times I need to login without having hands on my phone.
I guess the time based aspect of the TOTP makes it a little more resistant to having someone monitor my keystrokes or clipboard or whatever and capture a relatively long lived secret like my password. So I guess its a comprise I’m willing to make.
If you only need one factor to log into your password manager, you’re doing it wrong.
That’s still a single point of failure. What happens if someone finds an exploit that bypasses the login process entirely?
That’s still a single point of failure.
So is TLS or the compromise of a major root certificate authority, and those have no bearing on whether an approach qualifies as using 2FA.
The question is “How vulnerable is your authentication approach to attack?” If an approach is especially vulnerable, like using SMS or push notifications (where you tap to confirm vs receiving a code that you enter in the app) for 2FA, then it should be discouraged. So the question becomes “Is storing your TOTP secrets in your password manager an especially vulnerable approach to authentication?” I don’t believe it is, and further, I don’t believe it’s any more vulnerable than using a separate app on your mobile device (which is the generally recommended alternative).
What happens if someone finds an exploit that bypasses the login process entirely?
Then they get a copy of your encrypted vault. If your vault password is weak, they’ll be able to crack it and get access to everything. This is a great argument for making sure you have a good vault password, but there are a lot of great arguments for that.
Or do you mean that they get access to your logged in vault by compromising your device? That’s the most likely worst case scenario, and in such a scenario:
- all of your logged in accounts can be compromised by stealing your sessions
- even if you use a different app for your 2FA, those TOTP secrets and passkeys can be stolen - they have to be on a different device
- you’re also likely to be subject to a ransomware attack
In other words, your only accounts that are not vulnerable in this situation solely because their TOTP secret is on a different device are the ones you don’t use on that device in the first place. This is mostly relevant if your computer is compromised - if your phone is compromised, then it doesn’t matter that you use a separate password manager and authenticator app.
If you use an account on your computer, since it can be compromised without having the credentials on device, you might as well have the credentials on device. If you’re concerned about the device being compromised and want to protect an account that you don’t use on that device, then you can store the credentials in a different vault that isn’t stored on your device.
Even more common, though? MITM phishing attacks. If your password manager verifies the url, fills the password, and fills your TOTP, then that can help against those. Start using a different device and those protections fall away. If your vault has been compromised and your passwords are known to an attacker, but they don’t have your TOTP secrets, you’re at higher risk of erroneously entering them into a phishing site.
Either approach (same app vs different app) has trade-offs and both approaches are vulnerable to different sorts of attacks. It doesn’t make sense to say that one counts as 2FA but the other doesn’t. They’re differently resilient - that’s it. Consider your individual threat model and one may be a better option than the other.
That said, if you’re concerned about the resiliency of your 2FA approach, then look into using dedicated security keys. U2F / WebAuthn both give better phishing resistance than a browser extension filling a password or TOTP can, and having the private key inaccessible can help mitigate device compromise concerns.
That’s still a single point of failure. What happens if someone finds an exploit that bypasses the login process entirely?
I read this as someone bypassing the GitHub login entirely. Good luck 2FAing your way out of that one! 😜
That’s minimal to me. I chose 1password for this exact reason, read all of their technical docs.
1password uses encryption with a 2-part key, your password and your “Secret key” which is essentially a salt. Combining those two, they encrypt your entire storage blob and store it. They’re very clear that there is no backdoor, there it is encrypted using your keys, and they do not store those keys anywhere - and that if you lose your keys you’re out. There are zero recovery options. Which I love. (Which means I do not recommend it to non tech folks who will probably lose one of these keys)
So the secret key is similar to a guid, can have that written down somewhere, and your password should never be written down anywhere, and be completely unique. Doing those two things, I feel confident that keeping my 2FA in my most secure area is safe. There is minimal chance that someone is able to log in remotely to my 1password, even if they got my key, my password isn’t written down.
The convenience of this is x1000, while the risk to me is negligible. It’s why when I worked in fintech it was the manager of choice, and I recommend it for secrets in kubernetes. Until they prove me wrong, security is truly number one with them.
I love 1Password, they’re great (I personally use Bitwarden for my passwords, but would happily recommend either of them). But by putting both your authenticator codes and your passwords in the same place, you now have a single point of failure. What happens if someone finds an exploit in 1Password that gives them access to your account? The whole point of 2FA is to not have a single point of failure.
I’ll happily take that chance for the convenience. Even if 1password leaks, they don’t have the keys to my vault. They would need my key and password to unlock it. The only time that isn’t needed is if it’s unlocked, which only is on my linux computer, which means they need to find an exploit with their app. In the 7 years I’ve used them I’ve never even heard a wiff of something even small happening.
What’s wrong with using a Foss TOTP app?
Yeah, this is important to realize. Most good 2FA implementations offer TOTP which doesn’t need a proprietary app. You can store all of your 2FA secrets in whatever app or password manager you like.
Its more secure and ssh keys are more convenient anyways
I don’t love the idea of having an authenticator app installed on my phone
For anything? Why not? Surely you don’t believe SMS-based TOTP is safer, right?
Wut. TOTP doesn’t involve sending an OTP. That’s the point.
“SMS-based TOTP” is a nonsensical phrase
“Time-based One-Time Password” literally says nothing about the delivery method. Who said it can’t involve remote sending?
And what would you call it, then, SOTP?
Anyway, regardless of the terminology-nitpicking, my point still stands.
The point of being time based is to not send it. That’s the whole point. To avoid that vecotor of attack.
Do you think the SMS codes are not time-based on the companies’ ends? How are they deriving the digits, then?
They are not time based, correct.
Interesting, I didn’t know that. So how do they derive the digits?
Best practice for a cryptographic nonce is to generate them randomly every time
This hate for 2FA is bizarre to me. Sure, it’s not as convenient but in this day and age, with all the threats out there, there’s no real excuse for not using it.
Contributing to github is contributing to Microsoft’s AI poison which can steal your code from you regardless of license for another project that might use an incompatible license. To hell with github.
last time I signed into my Microsoft 365 account for work I got two separate 2fa prompts and two captchas, it was like being in an episode of the crystal maze. the mere act of signing into something is now tedious and difficult
I already use
pass(“the unix password manager”) and there’s a pretty decent extension that lets it handle 2fa: https://github.com/tadfisher/pass-otpWorth noting that this somewhat defeats the purpose of 2fa if you put your GitHub password in the same store as the one used for otp. Nevertheless, this let’s me sign on to 2fa services from the command line without purchasing a USB dongle or needing a smartphone on-hand.
Your two factors shift to possession of your password vault + knowledge of the password to it. You’re okay IMO.
You also still get the anti-replay benefits of the OTPs, though that might be a bit moot with TLS everywhere.
You’re right, I should have been more specific.
If you’re already storing your password using
pass, you aren’t getting 3 factors withpass-otpunless you store the otp generation into a separate store.For services like GitHub that mandate using an otp, it’s convenient without being an effective loss of 2fa to store everything together.
pass otp. Works, more secure then SMS, open source.
I use keepassxc to generate the code.
Agreed, me to! And I use syncthing to sync my database between my devices Edit: mine is called KeePassDX but its the same database file
I just use Bitwarden’s 2FA functionality.
This is premium functionality, for those who don’t know.
They have a free application too:
https://play.google.com/store/apps/details?id=com.bitwarden.authenticator
This app is actually free (as in freedom) and not merely gratis.
Can it export the seeds?
And I heard that if you self host you can use the premium features for free
I believe thats only true for the unofficial version (Vaultwarden - API compatible to any Bitwarden app)
Worth the price for Bitwarden’s good practices imo, now if I could export all of my authy keys…
I know it’s possible, but Authy has made it a PITA… fuck authy.
It’s fine. The added security is huge
The problem is when they want you to install their TOTP app in order to authenticate (I’m looking at you, steam… fuck off)
How’s that? I’ve had TOTP in my github account for over a year, on Aegis, and I have not seen them asking me to do anything else.
GitHub is not an offender right now, but I can easily imagine Microsoft forcing some MS OTP app in the future
Agreed. It would surprise nobody.
Or like eBay
If you’re rooted, Aegis can import the seed from the Steam app then you don’t need it anymore.
Oh, that’s awesome!
But I don’t have root
You may be able to use an older version of the app that allowed ADB backups, and extract the seed from that.
Another approach is to extract it from the Steam desktop app.
No idea what companies think they’re accomplishing by using non-standard TOTP apps (that actually do TOTP under the hood). Microsoft do it so they can track your location and report it to managers when you login because it’s something that management asks for. Some companies do it so they can lock you into their services. No idea why Steam does it.
There’s an easier way: https://help.ente.io/auth/migration-guides/steam/
Thanks, I didn’t know about
steamguard-cli. And I was able to import the code into Aegis too (just had to set the type to “Steam” so it would generate 5-letter codes instead of normal TOTP)…
You don’t need root. https://help.ente.io/auth/migration-guides/steam/
Thank you!!
I do agree but Steam’s app isn’t bad. It’s great if you use Steam’s social features and it makes secure login a total breeze.
It’s not that the app is good or bad. It’s that you are FORCED to use it when there is no technical reason for that requirement.
Let me reiterate: fuck valve
Sure, I don’t disagree, it shouldn’t be a requirement but because the app is good and makes the process easy, I don’t have a problem with it.
Exactly. At the end of the day there’s nothing being transmitted with OTP and using a standard app isn’t an issue.
I think I’d still prefer to use a 3rd-Party TOTP app but at least Steam’s app adds some value by pushing a notification when you login.
I hate that. I think it’s lazy af.
You can use Steam with a regular third-party TOTP authenticator, here’s a guide on how to set it up: https://help.ente.io/auth/migration-guides/steam/
You can use Steam with a regular third-party TOTP authenticator, here’s a guide on how to set it up: https://help.ente.io/auth/migration-guides/steam/
Steam is okay in my book because steam was the OG 2FA provider. They forced 2FA on everyone, all the way back in 2007, they took security seriously before anyone else really cared. So, they’re grandfathered in.
SMS is the least secure form of 2FA, and sim swaps are a very real thing. Whatever you’re issues with 2FA apps are, I can 100% say that you should be more concerned about actors getting access to your account.
And this isn’t just GitHub. You should be using a 2FA app for allllll of your services. Breaches are a daily thing, your passwords are online and are available. 2FA may be the only thing defending you right now, and SMS 2fa or email 2fa I wouldn’t trust.
SMS 2FA is still better than no 2FA.
But it should be the last resort. It makes sense why it’s being phased out
Well we could be using passkeys right now if Big Tech weren’t trying to tie them to their own platforms! 🤷
Unfortunately many banks still require it and have no other methods available. I tried to reason with my bank about it but they just do not care.
Not if the org uses SMS auth as a recover method for your “lost” password
Also putting a phone number into a DB means the attackers who dump the DB now have a very effective way to phish or exploit you with a large attack surface.
I generally don’t let my team enter phone numbers into their account data.
This, but my random, account-specific 20 char passwords are not online and available.
Totally agree! 2FA on all the accounts that support it avoiding SMS. And different passwords (complex, auto generated by a password manager) for each single account. I may be paranoid, but I also use a different email alias (SimpleLogin) for every single account! 😆
same, a simple habit that is secure, I use it always with maximum privacy. One day you will be in a rush, under stress, affected by age, and use your old habits with a valuable asset…
I deleted my github account because fuck microsoft. Open source should not be hosted on their servers.
In regards to forced 2fa, as I don’t need it on my projects, there would be literally nothing lost if somebody gets into my account.
Just for the convenience I moved them to my selfhosted forgejo and mirroring to sr.ht as a backup.
ITT: People who think they know better than security researchers
