GitHub starts enforcing 2FA - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: March 10, 2023, 01:38:33 pm
content: GitHub to require 2FA for all contributors starting from March 13:https://techcrunch.com/2023/03/09/github-to-require-2fa-for-all-contributors-starting-from-march-13-to-secure-the-software-supply-chain/Nice and simple TOTP tool for linux: OTPClient

author: Peabody
author_rank: Super Contributor
timestamp: March 10, 2023, 05:30:03 pm
content: If someone doesn't have a smartphone or other mobile device, and is running Windows on his laptop, is there a way to set up 2FA at Github, or is he just SOL?

author: madires
author_rank: Super Contributor
timestamp: March 10, 2023, 05:34:47 pm
content: There are also plenty of TOTP tools for windows, e.g. 2fast (https://github.com/2fast-team/2fast).

author: golden_labels
author_rank: Super Contributor
timestamp: March 10, 2023, 06:27:18 pm
content: On March 13th GitHub starts rolling it out. The first wave of enforcement will not apply before July.

author: JohanH
author_rank: Frequent Contributor
timestamp: March 10, 2023, 07:05:31 pm
content: It's also convenient to use SSH protocol.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 10, 2023, 07:38:38 pm
content: Quote from: JohanH on March 10, 2023, 07:05:31 pmCan SSH be used without 2FA?

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 10, 2023, 07:43:05 pm
content: Currently, to push to a repo you need your username, and github token as a password.How will 2FA work when using command-line tools?

author: ejeffrey
author_rank: Super Contributor
timestamp: March 10, 2023, 07:55:51 pm
content: To command line push to a repo with mandatory 2FA, I believe you currently need to use the git/ssh protocol instead of https and you need to authorize your ssh public key to your account which functions as the "second factor" although it's actually only one factor as it doesn't ask for your account password when you push.

author: mwb1100
author_rank: Frequent Contributor
timestamp: March 10, 2023, 08:15:04 pm
content: Enabling 2FA on github affects pushing to/pulling from a repository only if you are using HTTPS as the git protocol. If you're using SSH already it will be unaffected.For pushing/pulling with HTTPS you will need to generate an HTTPS "token" to use as the password instead of using your web account's password.See the following for details:-Using two-factor authentication with the command line-Creating a personal access tokenThe "Using two-factor authentication with the command line" page also talks about Git Credential Manager. As far as I know, that doesn't change what I said above - what is does is allow git to remember the HTTPS access token for a repository so after the first use you won't have to copy/paste it into an authentication dialog again.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 10, 2023, 08:27:12 pm
content: Quote from: mwb1100 on March 10, 2023, 08:15:04 pmThat's what I've already been doing, then. So, no change as far as I'm concerned.I'm a bit failing to see how that is 2FA, though. The token just has a limited lifetime that you can adjust, but that's still just like a password. It's just one that github generates for you.And you either need to type the token for every freaking command line (I c/c it, but that's still annoying), or store it in some configuration file in clear, which I don't do as it's horrific in terms of security.

author: golden_labels
author_rank: Super Contributor
timestamp: March 10, 2023, 09:16:00 pm
content: As far, as I understand, the change only applies to the cases using weak authentication. Not SSH, which is not vulnerable to service-side leaks, uses two factors by design, and provides resistance against phishing.For most users this means: using the webapp. This is the primary reason to have an account on GitHub, but the change seems to not be preventing e.g. pushes by designated collaborators.

author: mwb1100
author_rank: Frequent Contributor
timestamp: March 10, 2023, 09:36:11 pm
content: "Classic" github tokens are about 36 random characters long.Newer "fine-grained" tokens are about 80 random characters long.These are *much* stronger than your typical web account password.Also I was wrong about what I said for Git Credential Manager. The basic "git credential store" stores passwords in a plaintext file (I'd still argue that a plaintext file on a local machine with a long random password is generally still more secure than using a web account password in most cases). However the "Git Credential Manager" (sometimes referred to as "Git Credential Manager Core") is a separate project that adds credential management using a system's secure storage (ie., the Windows Credential Manager on Windows) as well as supports actual 2FA authentication.From theGCM readme:QuoteIf locally stored plaintext passwords are a concern you should look into Git Credential Manager.-Git Credential Manager: authentication for everyoneAnother thing I forgot: Git for Windows includes GCM now, so you might be using it already if you're on Windows.

author: alm
author_rank: Super Contributor
timestamp: March 10, 2023, 10:38:35 pm
content: Quote from: Peabody on March 10, 2023, 05:30:03 pmMany password managers that you might use, like Keepass, or 1Password, can also function as TOTP generator. Of course you should evaluate the security implications of this. It's definitely a step down from having the secret stored on a separate device (mobile phone).Quote from: mwb1100 on March 10, 2023, 09:36:11 pmAnd SSH private keys are much longer than that. And is an asymmetric system, so the private key is never transmitted. Plus SSH keys have the ability to protect them with a passphrase (two factor) and optionally remembering this passphrase for the duration of the session built in. I don't understand jumping through so many hoops just to be able to use HTTPS, unless you are behind a very restrictive firewall. But Github allows SSH over port 443, so even that's not a very convincing argument. What advantage do you see of using HTTPS instead of SSH for authenticated access?Quote from: mwb1100 on March 10, 2023, 09:36:11 pmUntil you run into an URL of more than 256 characters (happens with some automatically-generated URLs), then the Windows Credential Manager is useless and you have to fall back to plain text store. I haven't seen this issue on Linux or Mac, fortunately.

author: golden_labels
author_rank: Super Contributor
timestamp: March 11, 2023, 05:47:29 am
content: Quote from: alm on March 10, 2023, 10:38:35 pmJust to be clear, what are the numbers: typical SSH keys are 240–512 bits, a 80-character token is 376–480 bits. So the entropy is in both cases in a similar range.Quote from: alm on March 10, 2023, 10:38:35 pmThe primary reason to even use GitHub are features outside of the Git itself. These are available only through their webapp or, at most, HTTPS-only API. SSH is also a solution inaccessible to most of GitHub audience.

author: mwb1100
author_rank: Frequent Contributor
timestamp: March 11, 2023, 08:31:50 am
content: Quote from: alm on March 10, 2023, 10:38:35 pmI do generally use SSH and understand that it is better then HTTPS tokens in most ways. I'm just explaining reasons why the HTTPS tokens are more secure than using the web account credentials. Clearly a lot of people use HTTPS access or github, gitlab and other git hosting outfits wouldn't jump through hoops to support it. People who use Windows are generally unfamiliar with SSH, and as an example several people I work with use HTTPS for github and gitlab access. I might suggest or encourage using SSH, but I'm not going to force anyone else to use SSH.Quote from: alm on March 10, 2023, 10:38:35 pmI wasn't aware of that limitation. Do you have a pointer to more information about this behavior? I can' t find any issue or discussion topic about it at thehttps://github.com/git-ecosystem/git-credential-managersite.

author: madires
author_rank: Super Contributor
timestamp: March 11, 2023, 11:22:55 am
content: I'm also using ssh for accessing repos and created a dedicated key set for GitHub. In openssh it's easy to tie a key to a specific domain (.ssh/config):Code:# dedicated key for GitHubHost github.comUser gitIdentityFile ~/.ssh/myGitHubKeyIdentitiesOnly yesUpdateHostKeys yesIIRC, you can alternatively change the git settings of the local repo copy to use a specific ssh key. It's just less convenient.

author: Peabody
author_rank: Super Contributor
timestamp: March 11, 2023, 02:39:18 pm
content: I have 10 Github repos, but have never installed git or any github web app. I just use my browser in Windows to create and modify the repos on the site. Can someone clarify if the 2FA requirement will apply to me, and if so how I can satisfy it. I don't use a mobile device. 2fast was mentioned earlier, but Github's explanation of 2FA says a phone is required.> For GitHub, the second form of authentication is a code> that's generated by an application on your mobile device or> sent as a text message (SMS). After you enable 2FA, GitHub> generates an authentication code any time someone attempts> to sign into your account on GitHub.com. The only way> someone can sign into your account is if they know both> your password and have access to the authentication code on> your phone.

author: shapirus
author_rank: Super Contributor
timestamp: March 11, 2023, 02:42:36 pm
content: Quote from: golden_labels on March 11, 2023, 05:47:29 amThis is an interesting statement.I thought GitHub was used mostly by programmers. Was I wrong?

author: madires
author_rank: Super Contributor
timestamp: March 11, 2023, 03:49:33 pm
content: Quote from: Peabody on March 11, 2023, 02:39:18 pmIt's explained here:https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authenticationYour second factor can be:- TOTP (app on mobile device, PC or whatever)- SMSAnd after setting up 2FA with TOTP or SMS you can add additionally:- security key- GitHub Mobile app

author: Peabody
author_rank: Super Contributor
timestamp: March 11, 2023, 04:04:16 pm
content: Maybe it's just shorthand, and not literally true, but they talk only about a "TOTP mobile app".

author: shapirus
author_rank: Super Contributor
timestamp: March 11, 2023, 04:12:14 pm
content: Quote from: Peabody on March 11, 2023, 04:04:16 pmTOTP is just an algorithm. Any computer can be programmed to run it.

author: Karel
author_rank: Super Contributor
timestamp: March 11, 2023, 04:50:26 pm
content: Quote from: madires on March 10, 2023, 01:38:33 pmThanks but I moved everything from github to Gitlab.I stay away from tech giants because they are arrogant and do whatever they like.The last thing I'll do is giving them my telephone number.

author: jonovid
author_rank: Super Contributor
timestamp: March 11, 2023, 05:13:41 pm
content: look for other open source software development project sites Not owned by tech giant MS

author: madires
author_rank: Super Contributor
timestamp: March 11, 2023, 05:18:53 pm
content: Quote from: Peabody on March 11, 2023, 04:04:16 pmApparently they assume that the second factor should be on a different device. However, as shapirus mentioned, TOTP is a standard described in RFC6238. You can even run that on an Arduino (https://github.com/lucadentella/TOTP-Arduino).

author: Peabody
author_rank: Super Contributor
timestamp: March 11, 2023, 05:25:23 pm
content: For Arduino? Now I'm interested.

author: golden_labels
author_rank: Super Contributor
timestamp: March 11, 2023, 05:28:42 pm
content: Quote from: Peabody on March 11, 2023, 02:39:18 pmWould it be a problem, if I asked: what is the motivation behind using GitHub in that instance?Quote from: Peabody on March 11, 2023, 02:39:18 pmYes, it will.Quote from: Peabody on March 11, 2023, 02:39:18 pmPhone will not be required and, while remain an available option, GitHub discourages this option:QuoteQuote from: shapirus on March 11, 2023, 02:42:36 pmYes, it is used mostly by programmers. You are not wrong in that. But you may be wrong in making additional assumptions about what “being programmer” implies.Quote from: Karel on March 11, 2023, 04:50:26 pmAre you sure, you ran away? Or were misled into believing GitLab is some small, nice company? It s an NASDAQ-traded international corporation at the same scale as GitHub.Quote from: Karel on March 11, 2023, 04:50:26 pmYou somehow missed, that GitHub explicitly asks tonotuse mobile phone for that purpose.

author: Peabody
author_rank: Super Contributor
timestamp: March 11, 2023, 05:41:17 pm
content: Quote from: golden_labels on March 11, 2023, 05:28:42 pmNot a problem at all. I use it to post software I've written, and some circuits I've developed, that might be useful to others, and that I can link to from forums like this. I don't have any other place to post it. From looking around there, it appears a lot of other people use Github for the same purpose.

author: shapirus
author_rank: Super Contributor
timestamp: March 11, 2023, 05:42:50 pm
content: Quote from: golden_labels on March 11, 2023, 05:28:42 pmWell, may or may not. I guess I won't be very wrong if I say that git (as well as many other protocols) over ssh is the industry-standard approach. SSH is a well-established and very convenient way of tunnelling IP protocols over an encrypted TCP connection.

author: golden_labels
author_rank: Super Contributor
timestamp: March 11, 2023, 06:38:06 pm
content: It is common in major companies in European and North American countries, and possibly some dependent companies elsewhere. That is hardly a representative sample of people engaging in programming. And even in this case workers rarely set SSH up themselves.

author: shapirus
author_rank: Super Contributor
timestamp: March 11, 2023, 06:58:58 pm
content: Quote from: golden_labels on March 11, 2023, 06:38:06 pmI would fire the developer who can't set up an SSH client without any hesitation. This is one of the very basic skills of the profession.(and I haven't ever met any who couldn't.)

author: mwb1100
author_rank: Frequent Contributor
timestamp: March 11, 2023, 09:23:15 pm
content: Many password managers support 2FA protocols. The one I use (SafeInCloud) is free - but not open source - for the Windows desktop.You don't need to use a phone if you don't want to.

author: mwb1100
author_rank: Frequent Contributor
timestamp: March 11, 2023, 10:02:00 pm
content: Quote from: shapirus on March 11, 2023, 06:58:58 pmSSH is not particularly common on Windows, and the SSH tools that come with Windows (even Win11) are old and broken, so you will likely have to find an alternative set of tools and get them installed and configured.And as I noted before, clearly there is a large set of github users who don't use SSH, otherwise github (and others) would likely not put in the effort to support pushing & pulling using HTTPS with special tokens or 2FA.Quote from: shapirus on March 11, 2023, 05:42:50 pmDo you realize that when you click on the button to get a repository URL from github that the default is HTTPS? I'd guess that the vast majority of people pushing to github (and without a doubt pulling from github) are using HTTPS - especially people using Windows.

author: shapirus
author_rank: Super Contributor
timestamp: March 11, 2023, 10:27:15 pm
content: Quote from: mwb1100 on March 11, 2023, 10:02:00 pma software developer who uses windows is, at least, suspicious, because it's the OS which is specifically designed to kill the programmer's productivity.

author: mwb1100
author_rank: Frequent Contributor
timestamp: March 12, 2023, 02:36:50 am
content: Seems a few people disagree. Fromhttps://www.thurrott.com/dev/277533/report-more-developers-use-linux-than-a-mac:QuoteRegardless of your opinions of people who use Windows or don't use SSH, there's a lot of them. Hence github's HTTPS tokens.And one nice thing about that is that it doesn't prevent you in any way from using SSH. And there's a large pool of people for you to evangelize SSH (or put down).

author: PlainName
author_rank: Super Contributor
timestamp: March 12, 2023, 04:59:10 pm
content: Quote from: shapirus on March 11, 2023, 10:27:15 pmIn what way, and how does the OS do that?And is that worse than developing code on the product you're making? Some developers insist on having their RPi or similar compile the code, for instance.

author: alm
author_rank: Super Contributor
timestamp: March 13, 2023, 06:30:48 pm
content: Quote from: mwb1100 on March 11, 2023, 08:31:50 amIt's not a limitation in git credential manager, it's a limitation in Windows Credential Store. We had it with another tool that was using the Windows Credential Store. Looking athttps://learn.microsoft.com/en-us/windows/win32/api/wincred/ns-wincred-credentiala, I'm not 100% sure into what limit we ran. Maybe the one for the credentials blob? Either way, the end result was that we had to fall back to plain text files for secret storage on Windows system (a downgrade in security), while things worked smooth on Mac and Linux systems with their native secret stores.

author: c64
author_rank: Frequent Contributor
timestamp: March 14, 2023, 12:06:28 am
content: Quote from: shapirus on March 11, 2023, 10:27:15 pmIt depends which version of windows. My main dev workstation is Win7 (couple of years ago it was XP) and Debian is secondary. I find Win7 more convenient.