Configuring two-factor authentication - GitHub Docs
docs.github.com
You can choose among multiple options to add a second source of authentication to your account.

Just wondering what people are using to meet the 2FA requirement GitHub has been rolling out. I don’t love the idea of having an authenticator app installed on my phone just to log into GitHub. And really don’t want to give them my phone number just to log in.

Last year, we announced our commitment to require all developers who contribute code on GitHub.com to enable two-factor authentication (2FA)…

  • Reddfugee42@lemmy.world
    5·
    5 months ago

    Brilliant. Until that website’s unsalted pw database is downloaded through a SQL injection.

    Use both. You’re not smarter than security professionals.

    • kevincox@lemmy.mlM
      21·
      5 months ago
      1. Salt doesn’t matter if your password is unique.
      2. If they can download data via SQL injection having them log in probably doesn’t matter that much.
      3. If they can dump your password/hash they can likely also dump the TOTP secret.
      4. A lot of website security expert attention is focused on raising the minimum security level. If you are using randomly generated passwords + auto-fill you are likely above their main target audience.

      So yes, it is slightly better, but in practice that difference probably doesn’t matter. If you use U2F then you may have a meaningful security increase but IMHO U2F is not practical to use on every site due to basically being impossible to manage credentials.

      So yes, it is better. But for me using random passwords and a password manager it isn’t worth the bother.