On March 13, we will officially begin rolling out our initiative to require all developers who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023. Read on to learn about what the process entails and how you can help secure the software supply chain with 2FA.
No offense to companies but I’m honestly sick of companies forcing 2fa. Every single one seems to have a different shitty way of doing it. Like why on earth do I need two different authenticator apps on my phone (authy&google authenticator)? Some do sms/phone number, but then yell at you and prevent you from doing 2fa if you have a “bad phone number”. This happened on discord where I’m locked out of certain servers because I can’t do phone verification, and I can’t do it because discord doesn’t like my phone number. Twitter was the same way for a long while (couldn’t do 2fa/phone verification due to them not liking my number).
From the article it sounds like they’re doing authenticator app or sms. I’m guessing sms won’t work for me, so app it is. I decided to dig to see which authenticator app they use and they list: 1password, authy, lastpass, and microsoft… no google?
Honestly, even email requirements for accounts is annoying because you know it just ends up spamming you. is the future where we’re gonna have to have 30 different authenticator apps on our phone?
Like why on earth do I need two different authenticator apps on my phone (authy&google authenticator)?
you… don’t?
Both of these implement exactly the same protocol (TOTP). Used authy for all my Top Of The Pops Time-based one-time password needs exclusively, before moving everything to bitwarden
Unfortunately there are some websites that require Authy (probably because Authy wined and dined some business executive). I absolutely loathe these sites but if it’s a site you’re not willing to live without, you’re stuck with having Authy plus your main 2FA app.
which ones are that? I’d love to check, because afaik, they have a feature that enables push-2fa via authy, but should generally work on other apps as well
Sendgrid’s only options for 2FA are Authy (their proprietary token generation, no option for TOTP) or SMS. Tried signing up the other day and was surprised to find no option to use standard TOTP.
Are you sure that you can’t use a different TOTP generator? There’s a difference between telling you to use Authy and still being able to use a different app
Yes I’m sure, hence why I specifically mentioned that. Try the sign up procedure yourself. It REQUIRES 2fa and it has to be Authy’s non-standard token or SMS. No option for regular TOTP.
thx. just making sure. I already saw a lot of people annoyed about a specific app, just because that was the one being advertised, but in the end it was TOTP
Well the good news for you is that a website specifying one or the other is nothing more than marketing from that app maker! So long as there is a QR code (or a long random-ish string), you can use any authenticator app that supports that website’s 2FA algorithms!
That last bit is important because I think Lemmy had a non-standard 2FA algorithm (SHA-256?) that wouldn’t work with Google Authenticator.
Lemmy works with Google Authenticator, but not with Authy.
Annoyingly Authy fails silently and ignores the part of the code that specifies SHA-256 and just generates a SHA-1 code that won’t work with no warning or indication to the user.
BTW, any authenticator app works when it tells you to use one. They all use a standard, so it doesn’t matter which one you use.
Eh, it’s a little more nuanced than that, there’re more standards for MFA code generation than just TOTP.
And even within the TOTP standard, there are options to adjust the code generation (timing, hash algorithm, # of characters in the generated code, etc.) that not all clients are going to support or will be user-configureable. Blizzard’s Battle.net MFA is a good example of that.
If the code is just your basic 6-digit HMAC/SHA1 30-second code, yeah, odds are almost 100% that your client of choice will support it, but anything other than that I wouldn’t automatically assume that it’s going to work.
there’s quite a lot of services that want phone for verification/2fa/whatever. whenever I run into them I usually just refuse to use the service altogether.
How do you even use the internet? I mean, you could never book a flight, use any food rewards program, book a ride share, etc. Almost everything uses my phone number for 2FA.
Oh noes, 2 different authenticators? Between my two jobs I need: Google Authenticator, Microsoft Authenticator, Duo, CyberArk, Okta, Impriviata, and I must have LastPass for password management. Everyone demands their particular flavor of security. Not to mention I have to login to all of these 40 something accounts every 29 days so they don’t expire. Please, someone just everyone switch to a password-free security system like Microsoft Authenticator has and let’s just get rid of the song and dance of picking a new password all the time.
You might want to migrate away from LastPass. And change every account password. They were hacked horribly and the only thing standing between your encrypted passwords and hackers is time.
Google Auth works just fine. The standard for app generated 2FA is, well, standard. They’re only listing a non-complete list of options for people that don’t know what an authenticator app is and need to get one for the first time.
Mostly. The 6 digit standard ones that you see almost everywhere are standard TOTP codes and most apps work for them. There are some proprietary things out there too but you typically see those with a matching app from the same company. Those are far less common though so for practical reasons you can assume they are all interchangeable.
Those values are computed separately what the app is really storing is just the input values which are then combines with the current time to create the 6 digit code. That means that keeping that input value (seed) safe is a big deal, and how and where that is done is one of the major differentiators between the various options.
No offense to companies but I’m honestly sick of companies forcing 2fa. Every single one seems to have a different shitty way of doing it. Like why on earth do I need two different authenticator apps on my phone (authy&google authenticator)? Some do sms/phone number, but then yell at you and prevent you from doing 2fa if you have a “bad phone number”. This happened on discord where I’m locked out of certain servers because I can’t do phone verification, and I can’t do it because discord doesn’t like my phone number. Twitter was the same way for a long while (couldn’t do 2fa/phone verification due to them not liking my number).
From the article it sounds like they’re doing authenticator app or sms. I’m guessing sms won’t work for me, so app it is. I decided to dig to see which authenticator app they use and they list: 1password, authy, lastpass, and microsoft… no google?
Honestly, even email requirements for accounts is annoying because you know it just ends up spamming you. is the future where we’re gonna have to have 30 different authenticator apps on our phone?
you… don’t?
Both of these implement exactly the same protocol (TOTP). Used authy for all my
Top Of The PopsTime-based one-time password needs exclusively, before moving everything to bitwardenUnfortunately there are some websites that require Authy (probably because Authy wined and dined some business executive). I absolutely loathe these sites but if it’s a site you’re not willing to live without, you’re stuck with having Authy plus your main 2FA app.
which ones are that? I’d love to check, because afaik, they have a feature that enables push-2fa via authy, but should generally work on other apps as well
Sendgrid’s only options for 2FA are Authy (their proprietary token generation, no option for TOTP) or SMS. Tried signing up the other day and was surprised to find no option to use standard TOTP.
https://docs.sendgrid.com/ui/account-and-settings/two-factor-authentication
Are you sure that you can’t use a different TOTP generator? There’s a difference between telling you to use Authy and still being able to use a different app
Yes I’m sure, hence why I specifically mentioned that. Try the sign up procedure yourself. It REQUIRES 2fa and it has to be Authy’s non-standard token or SMS. No option for regular TOTP.
thx. just making sure. I already saw a lot of people annoyed about a specific app, just because that was the one being advertised, but in the end it was TOTP
websites explicitly said to get one or the other so I did.
Well the good news for you is that a website specifying one or the other is nothing more than marketing from that app maker! So long as there is a QR code (or a long random-ish string), you can use any authenticator app that supports that website’s 2FA algorithms!
That last bit is important because I think Lemmy had a non-standard 2FA algorithm (SHA-256?) that wouldn’t work with Google Authenticator.
Lemmy works with Google Authenticator, but not with Authy.
Annoyingly Authy fails silently and ignores the part of the code that specifies SHA-256 and just generates a SHA-1 code that won’t work with no warning or indication to the user.
that’s good to know. I’ll just switch everything over to google authenticator then.
BTW, any authenticator app works when it tells you to use one. They all use a standard, so it doesn’t matter which one you use.
Eh, it’s a little more nuanced than that, there’re more standards for MFA code generation than just TOTP.
And even within the TOTP standard, there are options to adjust the code generation (timing, hash algorithm, # of characters in the generated code, etc.) that not all clients are going to support or will be user-configureable. Blizzard’s Battle.net MFA is a good example of that.
If the code is just your basic 6-digit HMAC/SHA1 30-second code, yeah, odds are almost 100% that your client of choice will support it, but anything other than that I wouldn’t automatically assume that it’s going to work.
Anyone who claims they’re doing OTPs over SMS for “security” ia lying to you. Discord wants your phone number; it has nothing to do with your security
there’s quite a lot of services that want phone for verification/2fa/whatever. whenever I run into them I usually just refuse to use the service altogether.
How do you even use the internet? I mean, you could never book a flight, use any food rewards program, book a ride share, etc. Almost everything uses my phone number for 2FA.
There is literally no bank in my country that doesn’t use sms for 2fa.
Yes banks are terrible about this, and it makes no sense
what happens if you don’t have a phone number? you’re just prevented from having a bank account?
You can have a bank account, but you wouldn’t be able to do online or mobile banking.
Sms is the only 2fa option (some offer email as well, but last I checked all fall back on sms), and it’s mandatory for online/mobile.
Oh noes, 2 different authenticators? Between my two jobs I need: Google Authenticator, Microsoft Authenticator, Duo, CyberArk, Okta, Impriviata, and I must have LastPass for password management. Everyone demands their particular flavor of security. Not to mention I have to login to all of these 40 something accounts every 29 days so they don’t expire. Please, someone just everyone switch to a password-free security system like Microsoft Authenticator has and let’s just get rid of the song and dance of picking a new password all the time.
You might want to migrate away from LastPass. And change every account password. They were hacked horribly and the only thing standing between your encrypted passwords and hackers is time.
Well that and 2FA on everything.
Google Auth works just fine. The standard for app generated 2FA is, well, standard. They’re only listing a non-complete list of options for people that don’t know what an authenticator app is and need to get one for the first time.
The google auth which transmits your totp code in plaintext to there servers?
That is the specific app the person I replied to was asking about, so yea. Would have been a little weird if I was talking about some other app.
do all authenticators work for all services?
Mostly yes. I use Duo for everything.
Mostly. The 6 digit standard ones that you see almost everywhere are standard TOTP codes and most apps work for them. There are some proprietary things out there too but you typically see those with a matching app from the same company. Those are far less common though so for practical reasons you can assume they are all interchangeable.
Those values are computed separately what the app is really storing is just the input values which are then combines with the current time to create the 6 digit code. That means that keeping that input value (seed) safe is a big deal, and how and where that is done is one of the major differentiators between the various options.