GitHub Community
Replies: 8 comments 4 replies
-
|
Good one @potaders 👍 |
Beta Was this translation helpful? Give feedback.
-
|
yeah is great |
Beta Was this translation helpful? Give feedback.
-
|
it's nice with the 2FA so that we may be safe by the way even if i lost i know how i will recover my password so good and easy |
Beta Was this translation helpful? Give feedback.
-
|
Nice one @potaders !! |
Beta Was this translation helpful? Give feedback.
-
|
Excellent one @potaders |
Beta Was this translation helpful? Give feedback.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
Nice |
Beta Was this translation helpful? Give feedback.
-
|
that great !!! |
Beta Was this translation helpful? Give feedback.
-
|
Amazing. I would like to add something - free tools to recover windows password that would help. https://randomtools.io/blog/6-free-windows-password-recovery-tools/ |
Beta Was this translation helpful? Give feedback.
-
|
What's your take regarding sms_based_two_factor_authentication ? |
Beta Was this translation helpful? Give feedback.
-
|
Why can't I use two devices with Authenticator apps / TOTP? |
Beta Was this translation helpful? Give feedback.
-
|
You can, but you'll have to synchronize the TOTP secret between them yourself. If/how that works depends on the authenticator you use. |
Beta Was this translation helpful? Give feedback.
-
Why Use Two-Factor Authentication (2FA)?
While it's still relatively uncommon, data breaches happen. In some cases, that can mean that the login credentials of user accounts on a given platform fall into the wrong hands. If you've never visited it before, checking your email address (or addresses) at Have I been Pwned can be a sobering experience. As lots of people reuse passwords and other credentials across a number of platforms, one breach can impact on any number of accounts.
So what happens if your email and password are leaked and used by a malicious actor? When 2FA is not enabled, this information would be enough for a third party to access any online accounts that use those login credentials. Two-factor authentication throws up an additional barrier to keep your accounts more secure.
If you've ever used online banking, you've very likely to be requested to set up 2FA. The second 'factor' of authentication is an extra login requirement. This is quite often in the form of an SMS sent to your phone, biometrics like a fingerprint sensor, or a code generated by an authenticator application. When you login to your account, you're not only required to enter your email and password, but also to enter a one-time access code.
If someone gained access to your email and password but 2FA had been set up, they still wouldn't be able to access your account without that additional code, giving you an extra layer of securty and peace of mind.
While it's absolutely worth it (and recommended) to add 2FA to your account, what happens if you change your phone number without updating your 2FA settings, or accidentally delete the application that generates your access codes?
The Case For Additional 2FA 'Fallbacks'
In the worst case scenario, losing access to your 2FA credentials can mean that you'll also lose access to the account you've added 2FA to.
This is because 2FA requires the platform (in this case, GitHub) to verify account ownership with a second factor of authentication. Waiving the requirement would, unfortunately, undermine the purpose of having set up 2FA in the first place -- namely, to ensure that email and password credentials aren't the only thing used to verify account ownership.
This can leave you in a bind, where the very tools you've set up to protect your account, wind up costing you access to that same account.
Adding 2FA fallbacks is a remedy to that problem. As the name suggests, a 'fallback' is a different, additional method of authenticating if you lose access or run into issues with your primary 2FA method.
The Fallback Methods Available
At the time of writing, you can set a TOTP authenticator application or SMS (region allowing) as your primary method of two-factor authentication. Our help documentation includes a guide on configuring two-factor authentication that can help get you started.
In addition to that primary means of authentication, you can then add one or more of the following fallback methods:
While not an official or entirely dependable recovery mode, it's also occasionally possible to authenticate ownership via adding an SSH key to your account. However, this is not a recommended fallback so much as an additional potential recovery vector of last resort.
How Many Fallbacks to Add to Your Account
There's no right or wrong answer as to how many fallbacks to add to your 2FA setup. On the one hand, the more fallbacks you have at your disposal, the better protected you are against the failure or loss of one or more of them.
On the other hand, having more fallbacks can open the possibility of one or more of them finding their way into the wrong hands.
It's a good idea to have at least one fallback set up, and adding more than one is often considered good practice. However, it's important to make sure that the location of your fallbacks is both safe and, ideally, distinct from the device you use to access to your account.
Fallback Location
Let's say you decide to use SMS as your primary 2FA method for account authentication. You might then opt to use a set of recovery codes as your sole fallback.
The efficacy of that fallback will depend to a large extent on where those codes are stored.
On the one hand, if you store your recovery codes on the phone you use to login to your account and receive your primary 2FA method (SMS codes), you're at a considerable risk if you lose the phone.
On the other hand, if you primarily log in to GitHub via your laptop, have your codes sent to your phone as SMS messages, and have printed your recovery codes (or stored them in a password manager with cloud syncing capabilities), you'll have a much greater chance of being able to find and use your recovery options should you lose access to one or more of those devices.
In short, keeping your 2FA fallbacks in distinct, discrete locations will give you a higher chance of being able to access them. It's worth noting that keeping them in a secure place, such as an encrypted password manager application, will provide greater peace of mind than leaving a printout pinned to your desk.
Conclusion
Two-factor authentication undoubtedly provides a much needed additional layer of security for your GitHub account. While rare, breaches of account information have been known to happen on the web. However, with extra security comes the additional risk of losing access to your account.
Adding secure fallbacks to your 2FA setup, and keeping them in a safe, discrete, secure place can ensure that even in an emergency, you'll continue to enjoy access to your account without issues.
Additional Resources
Originally co-authored by: @piqrgb
Beta Was this translation helpful? Give feedback.
All reactions