GitHub Community
Mandatory 2FA #63738
-
|
Github now requires a phone and a subscription to use? What if I have neither? This is ridiculous. I have an e-mail, use that. I'm not maintaining a phone plan so that I can keep doing free work for projects. UpdateNo subscription needed, only smartphone with wifi access. To me personally, that's no longer outrageous. But. Not everyone has or can afford a smartphone. Github is supposed to be the open source leader - this goes against the mission. 2FA is significantly more secure and the "inconvenience" is a small price to pay when said security is needed. However, Github is yet to justify why this move is necessary, considering the downsides. I'm no security expert so it's best Github speak here. However, I'll lay a few prominent Pros & Cons to my mind: Pros: (1) password strength is ignored by keylogging; (2) irreparable damage can be done very quickly, before countermeasures are taken. Cons: (1) requiring smartphone ownership; (2) most users don't have something where irreparable damage is done to anyone but themselves (proprietary data etc), so it remains a personal choice - Github could instead narrow their mandate. |
Beta Was this translation helpful? Give feedback.
Replies: 74 comments 74 replies
-
|
Moreover SMS is not actually more secure than email, so the security claims are bullshit. |
Beta Was this translation helpful? Give feedback.
-
|
It's honestly the most annoying 2FA process I have ever attempted on the internet. At the end of the process, I still failed to get it right. I dont have all day at github.com just to keep trying to verify. WTF |
Beta Was this translation helpful? Give feedback.
-
|
It could be a honeypot designed to identify anonymous users. |
Beta Was this translation helpful? Give feedback.
-
|
A side channel doesn't need to be more secure to be useful. In theory, the probability of both being compromised is the probability of one being compromised multiplied by the probability of the other being compromised. But since there's a single point of attack that would compromise both (your phone) there's less real benefit in this specific 2FA scheme. |
Beta Was this translation helpful? Give feedback.
-
|
2FA is Mandatory, but Github website is broken and gives ERROR when using 2FA via Github mobile. 👏 👏 -.- This 2FA nonsense need to end... it prevents stealing account in like 0.1% of situations, but give issues in 50% of situations (that can even end with lost account) |
Beta Was this translation helpful? Give feedback.
-
|
I went abroad for 6 months 5 years ago never regained access to any of them IMHO 2FA is not worth the extra security except in highly sensitive systems (like your bank) this whole idea that it should be on every service we use is utter nonsense, I didn't need it on any of those services, and i wish i could disable it on github |
Beta Was this translation helpful? Give feedback.
-
|
4th mail about "ACTION REQUIRED - SET 2FA" and yet, I FUCKING CAN'T BECAUSE YOUR SYSTEM IS BROKEN!!!! FUCK YOU MICROSOFT! FUCK YOU GITHUB! |
Beta Was this translation helpful? Give feedback.
-
|
tried today again, as every day.... today 24th september they fixed first error. Still it fails at passkey... all I can use is password + SMS... and we know SMS is really weak factor of auth... so what is increased security here? Nothing. They don't care about security, they only want to know your phone number and more data, and have access to mobile device via their app. |
Beta Was this translation helpful? Give feedback.
-
I lost my OSRS account (LvL 32 thankfully) from formatting phone a while back, and that's when I realized 2FA is more of a threat than getting scammed. |
Beta Was this translation helpful? Give feedback.
-
Using cloud storage with no local backup for any critical file is just as dangerous as storing them on a single device using a single disk locally with or without 2FA. There are ways to lose access to the account even without 2FA. Computers storing data "in the cloud" (on someone else's computer) can fail just like yours. Usually backups are rather robust, but if corrupted files get to the backups too you may have problems. Cloud server and own computer can both be hacked. In both cases less likely with 2FA but not impossible and this comes with a side order of increased risk of being locked out. The entire host could go out of business or change business models to something so unsavory (e.g Photobucket selling biometrics from face photos for AI) you must walk away from your files if there is too much there for one big download. For files that do not create a security risk if accessed by worst-case third parties, the safe storage models are 1 local disk and one offsite cloud provider, two different cloud providers that never share the same data center (e.g the same Amazon AWS physical location), or two local disks one offline save when backup up or restoring from backups. One of these should be offsite if possible, that saved my ass once. |
Beta Was this translation helpful? Give feedback.
-
|
Nobody can dictate me what I have to use. They forcing me to use 2FA, I'll move to BitBucket or GitLab. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, I'll research it. Nice to have more options. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah this is the last straw for me I think |
Beta Was this translation helpful? Give feedback.
-
|
I'd be fine with it if you had to use 2fa for select actions, like adding a key - but for my everyday log in, no thanks. |
Beta Was this translation helpful? Give feedback.
-
|
Gitlab is the same shit. I just tried registering and not only will they force you into 2fa too, they also ask for your credit card even for the free version. |
Beta Was this translation helpful? Give feedback.
-
|
@technik That was not my experience. I think this is FUD. |
Beta Was this translation helpful? Give feedback.
-
|
If this authentication complexity increases the risk to fail to sign in my account, that doesn't mean safe |
Beta Was this translation helpful? Give feedback.
-
|
I agree that this is not a good move. I use MFA all the time and honestly hate it. It takes extra time, it interrupts my flow, it requires me to have access to my phone all the time, and it is especially aggravating when I'm working on a project that is SUPPOSED TO BE OPEN TO THE PUBLIC. I honestly don't care if some AI system or hacker or whatever "compromises" any of my public GitHub repos. In my view all of these companies moving for MFA is just so they can cover their own ass in the name of "enhanced security". There are many situations where MFA is only a cost and there is no benefit at all to end users. It's fine if they want to make this the default, but there should be a way to opt-out. |
Beta Was this translation helpful? Give feedback.
-
|
I absolutely hate the new 2FA requirements. |
Beta Was this translation helpful? Give feedback.
-
|
I have to say that I don't want to maintain a mobile app and potentially lose access to my account because of losing the phone. Can anyone clarify how exactly this is better than sending 2FA codes over email? |
Beta Was this translation helpful? Give feedback.
-
|
2FA is "security theater" It is not more secure than a strong password. |
Beta Was this translation helpful? Give feedback.
-
|
It is better for micro$oft: easier to steal personal data from your mobile device. |
Beta Was this translation helpful? Give feedback.
-
|
The requirement for 2FA is absurd. It should be opt-in, not forced on the user. It is, however, possible for somebody to steal my phone. I also do not approve of/appreciate the attempts by companies to force their way into every device I own. This needs to stop. I already have to use a verification code with my email when I log in. That should be sufficient as the 2nd factor in 2FA. I am not purchasing a physical authenticator just for GitHub, I am not going to install software on my phone just for GitHub. Forcing this onto users is not beneficial in any way. It's only value-added if it is optional. |
Beta Was this translation helpful? Give feedback.
-
|
I don't like this mandatory 2FA (without email as option) and mobile device dependency, I was ready to nuke my account and remove my open source projects... But I will tolerate just because my "2FA without a phone" workaround was so simple:
|
Beta Was this translation helpful? Give feedback.
-
|
install 2 possibly compromised pieces of software for security, no wonder everything gets hacked, I can manually trunk my source on my machine, for about the same space, and effort without adding 2 pieces of software with x amount of security holes each from the software or its depends |
Beta Was this translation helpful? Give feedback.
-
|
None of these options are good.
I cannot install an emulator on my PC at work.
If my computer has to get rebuilt for any reason, I'd be locked out of the
account because that instance of the android phone would be gone.
If I travel and don't have my primary PC, i'd be locked out of the account
because that instance of the android phone would be gone.
If something happened in my house and my PC was destroyed for whatever
reason, I'd be locked out of the account because that instance of the
android phone would be gone.
I appreciate that you are trying to offer helpful suggestions but none of
these fix the root problem that is "2FA will make my account MORE
vulnerable to being permanently inaccessible"
There shouldn't be workarounds, there shouldn't be sneaky things we do to
avoid the issue. The problem needs to stop at the source. GitHub needs to
walk this back. Make it available to those that want it, but do not force
it on those that do not want it.
…On Thu, Aug 24, 2023 at 12:57 PM DarknessFX ***@***.***> wrote:
I don't like this mandatory 2FA (without email as option) and mobile
device dependency, I was ready to nuke my account and remove my open source
projects... But I will *tolerate* just because my "2FA without a phone"
workaround was so simple:
- Install any Android Emulator for PC, install Google Authenticator
app (or any other), complete Github 2FA.
—
Reply to this email directly, view it on GitHub
<#63738 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AWSXUNQTRSQX25DG63P2WX3XW6BWTANCNFSM6AAAAAA3QESJNU>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
so there is YOU opensource 👎 what will happens with not validated acсounts? |
Beta Was this translation helpful? Give feedback.
-
|
That is the thing, they don't even specify what will happen if you reject 2FA. They write: "You will need to enable two-factor authentication on your account before October 12, 2023, or be restricted from account actions." The use threatening language is an insult to the github to community. I have not been able to find out what "be restricted from account actions" means. Github support is silent when asking for clarification. |
Beta Was this translation helpful? Give feedback.
-
|
@PiKeyAr I can confirm this, just got a response from github support, and the short version is that to login to your account on github.com after October 1, 2023, you must enable 2FA. So to delete your account, for example, you need to enable 2FA. Repositories will be left untouched, and pushing to repos will apparently still work. |
Beta Was this translation helpful? Give feedback.
-
|
i don't want to install an extra app on my phone just to login to github and my country isn't listed for sms authentication. |
Beta Was this translation helpful? Give feedback.
-
|
A sad trend, but apparently we will have to say goodbye to github. I also do not have the slightest desire to install additional software on the phone. It was a great resource for developers and creatives until it became an anal-enclosed sandbox. Perhaps we do not know something, and this is how it was originally intended. But as they say, the road to hell is paved with good intentions. |
Beta Was this translation helpful? Give feedback.
-
|
It does not give me any security to hand over my phone to Microsoft, quite the opposite. And as others have said, WTH has my phone to do with open source development anyway? None. I do not trust the intention behind this. Therefore, I will start the process to move away from Github, most likely to Gitlab. |
Beta Was this translation helpful? Give feedback.
-
|
It's more useless crap used to tie phones to people. |
Beta Was this translation helpful? Give feedback.
-
|
They hope to link online personas to real individuals because they can't stop scary hackers any other way, good point |
Beta Was this translation helpful? Give feedback.
-
|
They just want to invade privacy and sell data. |
Beta Was this translation helpful? Give feedback.
-
|
I have moved my repos to GitLab, worked very well to import them over, was easy! |
Beta Was this translation helpful? Give feedback.
-
|
Just adding my voice to the chorus: this absolutely stinks. This makes open-source development even harder for poor people, who don't happen to have a spare goddamn smartphone handy and reliable internet access. Personally, now I keep my 2FA backup codes in the same encrypted, cloud-synced password manager database file in which I already kept my GitHub password, because I'm not ever going to memorise more than 1 secure password unless there's a gun to my head, and even then it's 50:50. My phone is one of those computers that my password file syncs to, for obvious reasons. And my phone's 2FA needs to store its backup codes somewhere, so they're stored on my computer. In the same file. So what was the fucking point here? If they have my password database, I'm already in the absolute worst-case scenario. My GitHub password is written down in that password database and nowhere else. What situation could there possibly be wherein it's more secure for two computers (a desktop and a phone) to send some hash of the same duplicated set of secret data? 2FA using a phone is either a serious danger of locking you out of your data forever, or it's no more secure whatsoever. There's no win here. 2FA lockouts are only anything short of a total catastrophe when there's other people who can still access the data and personally verify you're not a threat. This is an idea for protecting organisations that's been stupidly forced upon millions of individuals. |
Beta Was this translation helpful? Give feedback.
-
Probably making a boycott organisation (wherein important maintainers could migrate their repos out of GitHub until demands are met), and also reaching out to GitHub employees or tech unions (I'm not sure if any are unionised) about potential strike action. In the current climate the latter is a stretch, but in a culture of regular striking and strong unions this kind of demand to protect customers/clients/broader society as well as workers used to be commonplace. GitHub employees have protested & resigned before regarding Palantir & ICE. Unfortunately according to this log of strike actions, and in keeping with the generally rightwing culture of IT/programming, the IT sector hasn't seen much industrial action in the last few years. |
Beta Was this translation helpful? Give feedback.
-
|
@howtophil I forked your No2FA project and modified the link to where I am migrating. I suggest others do the same. |
Beta Was this translation helpful? Give feedback.
-
|
Sounds like a good plan to me. |
Beta Was this translation helpful? Give feedback.
-
|
I entirely favor the strike. Real worst case: my MATE wayland work is developed privately, on my own machine, and the resulting source code is offered as patches against git master or against a release plus as patched tarballs on archive.org. I do not have a stable phone number-and I am subject to a conflicting security requirement for deniable ownership of phones and computers. I am hoping I can stay on the MATE team, but I have to put the security of the my devices ahead of this, and may have to walk away from my account as I did from all the US email providers a decade ago. |
Beta Was this translation helpful? Give feedback.
-
|
@howtophil I forked your repo, goodbye github. before I go, let me leave you with a sendoff |
Beta Was this translation helpful? Give feedback.
-
|
On 2024-10-27 03:07, llvee wrote:
Is there anyway we can request optional 2FA?
They want control over you, so no. The only way to 'request' optional
2FA is to abandon Github. I have been locked out from Github since more
than a year ago (answering this by email) because I will not give my
phone details to Microsoft. There are alternatives like Gitlab and if
more people migrated to such places Microsoft would not have the power
to enforce 2FA.
Open source should not be under the heel of companies like Microsoft.
|
Beta Was this translation helpful? Give feedback.
-
|
This isn't true, you can open a GH support ticket. 2FA being mandatory likely violates privacy laws such as GDPR as there is no option to have the associated data deleted in the 2FA settings so that alone is likely justification enough to make 2FA on by default with the option to turn it off as I suggested in my comment here. |
Beta Was this translation helpful? Give feedback.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
This requirement really, really pisses me off. Mobile phones are always having problems, no coverage, out of credit, technical problems. For example, my SIM failed today and my phone is now a brick. I will have to send off for a new SIM then reprogram my number to receive SMS calls. I don't want these sort of problems to prevent me from accessing github. I also do a lot of retro/legacy computing on Vax/VMS, Windows XP and ReactOS. When I am using those older systems no modern authorisation is ever going to be available. Lastly I do NOT want to access my fecking phone when coding on the desktop. I want to be free of this overly complex crap. Honestly, at the moment I fecking hate you for making this decison, I'd opt out in a second given the opportunity. Everything that Microsoft has a hand in, ultimately I end up HATING. |
Beta Was this translation helpful? Give feedback.
-
|
look into something like bitwarden I have all my authenticators in bitwarden's password vault And you can have bitwarden as an extension on any chromium browser, no need for a smart phone |
Beta Was this translation helpful? Give feedback.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
From my side: The 2FA is often very and VERY annoying, because I always put my phone far away on a shelf and never use it until I relaxing at the coach, but not when I work on PC. It's always annoying to just go and take that phone to just log in to the website... I have multiple devices from which I log in to GitHub, and that's annoying to every time go and take that phone. |
Beta Was this translation helpful? Give feedback.
-
|
I found GNOME's authenticator app works on my system, I would never connect any online account
to a phone number
|
Beta Was this translation helpful? Give feedback.
-
|
Or Microsoft and other places can stop all this 2FA security theater that
does nothing to add actual security to anything
…On Thu, Jan 30, 2025 at 6:05 PM Vulps ***@***.***> wrote:
look into something like bitwarden
I have all my authenticators in bitwarden's password vault
And you can have bitwarden as an extension on any chromium browser, no
need for a smart phone
—
Reply to this email directly, view it on GitHub
<#63738 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMVH3PYKTF3DG4N62CGPYT2NKV4DAVCNFSM6AAAAAA3QESJNWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTEMBRGIZTCMY>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
--
Phillip J Rhoades
HowToPhil.com
KE8GGD
|
Beta Was this translation helpful? Give feedback.
-
|
Agreed 100% . This 2FA theater does nothing to add security, all it does
is lock out people who do not accept to hand over private information to
Microsoft so they can spy on you.
I have not been able to log into my github account for 18 months.
…On 2025-01-31 00:44, Phillip (HowToPhil) Rhoades wrote:
Or Microsoft and other places can stop all this 2FA security theater
that does nothing to add actual security to anything
|
Beta Was this translation helpful? Give feedback.
-
|
TOTP does not require a phone; you can implement it on your computer. Nevertheless, it does not really improve security much (like many other people mention). However, I tried to set it up anyways and it does not work; it just gets stuck in a loop. If they used X.509 client certificates for authentication, that would actually improve security (if someone acquires a copy of your certificate (e.g. due to MITM) that does not allow them to log in as you), and has several other advantages (e.g. it is a better way to implement single sign on, and does not require JavaScripts); furthermore, the private key can be passworded which means that it is also like 2FA. However, if they want to secure against supply chain attacks, probably signed releases (which is already possible, without needing 2FA) would be better; this way, the people who own GitHub (or anyone else who manages to access your account without your permission) cannot tamper with it; other people can verify it without needing to trust Microsoft or GitHub or someone else. |
Beta Was this translation helpful? Give feedback.
-
|
June 2025. My account was made last year, and today I received a Github notification stating that I have 1 month to enable 2FA or get locked out. Found this thread while searching the web for solutions. |
Beta Was this translation helpful? Give feedback.
-
|
they do this so they can get more of your devices on record, to steal more of your data for resale. because apparently giving them code for free wasn't enough. |
Beta Was this translation helpful? Give feedback.
-
|
I'm about to lose access to my account due to this bullshit. I do not accept it. and of course it comes around the same time as the youtube verification ai, kosa, and other ridiculous internet nonsense. and I too am thinking about abandoning github over this. |
Beta Was this translation helpful? Give feedback.
-
|
Github has become a crap site, and devs should be moving with all due haste
…On Mon, Aug 18, 2025 at 5:23 PM GodwayGames ***@***.***> wrote:
I'm about to lose access to my account due to this bullshit. I do not
accept it. and of course it comes around the same time as the youtube
verification ai, kosa, and other ridiculous internet nonsense. and I too am
thinking about abandoning github over this.
—
Reply to this email directly, view it on GitHub
<#63738 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMVH3LGCR5NSIEZEKALG5L3OI76JAVCNFSM6AAAAAA3QESJNWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMJUGY2DENA>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
--
Phillip J Rhoades
HowToPhil.com
KE8GGD
|
Beta Was this translation helpful? Give feedback.
-
|
there aren't many places to go, there's like bitbucket and gitlab and those are literally the only ones I know of and i've never used either. I was hesitant to even start a github if i'm being honest and I'm now regretting it. |
Beta Was this translation helpful? Give feedback.
-
|
Looked at Codeberg?
…On Mon, Aug 18, 2025 at 10:47 PM GodwayGames ***@***.***> wrote:
there aren't many places to go, there's like bitbucket and gitlab and
those are literally the only ones I know of and i've never used either. I
was hesitant to even start a github if i'm being honest and I'm now
regretting it.
—
Reply to this email directly, view it on GitHub
<#63738 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMVH3JWRYEYZ4GD7QQBC3D3OKF2JAVCNFSM6AAAAAA3QESJNWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMJUG44TONY>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
--
Phillip J Rhoades
HowToPhil.com
KE8GGD
|
Beta Was this translation helpful? Give feedback.
-
|
i haven't heard of this one before. it seems to be based in germany? that seems like it could become an issue. |
Beta Was this translation helpful? Give feedback.
-
|
Absolutely ridiculous waste of time =/ |
Beta Was this translation helpful? Give feedback.
-
|
I do not support this, I do not want this, and with github becoming part of microsofts coreAI team; I am thinking about cancelling all of my github projects and leaving. I don't want to take away from the people here but I don't want to be forced to support shit like this either. I will not support scraping peoples public or PRIVATE repositories to fuel an LLM, and I will not support mandatory 2FA so that they can steal more of our data. Microsoft has turned into one of the worst companies on the planet and I hope they go bankrupt. |
Beta Was this translation helpful? Give feedback.
-
|
There's a silver lining to MS using GH to train LLMs: most of the code on GH is so horrendous that the LLMs are complete trash as well. Ironically, the DEI epidemic is saving us from AI. |
Beta Was this translation helpful? Give feedback.
-
|
On 2025-09-04 03:30, FrederickDietz wrote:
I do not support this, I do not want this, and with github becoming
part of microsofts coreAI team; I am thinking about cancelling all of
my github projects and leaving. I don't want to take away from the
people here but I don't want to be forced to support shit like this
either. I will not support scraping peoples public or PRIVATE
repositories to fuel an LLM, and I will not support mandatory 2FA so
that they can steal more of our data. Microsoft has turned into one of
the worst companies on the planet and I hope they go bankrupt.
I agree entirely. Microsoft effectively closed down my github account 2
years ago when they forced me to accept 2FA or leave. So I left. Github
is no longer a suitable place for open source software because of
Microsofts abuse of it. This reply was sent by email.
|
Beta Was this translation helpful? Give feedback.
and others
There is no 2FA,
practically. Phone is used once - then you get recovery codes, basically "second password". They're one-time use, but you can always generate new.
This entire situation is just Github being bad at communicating.
And, that's cool but, they've still screwed over those who lack smartphones, and can't afford them. I was one of them not that long ago. If using recovery codes each time is acceptable, then I think the requirement should be left at that, and be as annoying nagging as they want on the optional mobile 2FA.
Re: protests
Concerning "boycotts" and such: at some point it's time to put down pitchforks and admit it's not that bad. It's fair to still complain, but doomcal…