It's fine. The added security is huge
The problem is when they want you to install their TOTP app in order to authenticate (I'm looking at you, steam... fuck off)
this post was submitted on 05 Jun 2024
46 points (78.0% liked)
Open Source
31679 readers
752 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon from opensource.org, but we are not affiliated with them.
founded 5 years ago
MODERATORS
I think I'd still prefer to use a 3rd-Party TOTP app but at least Steam's app adds some value by pushing a notification when you login.
Steam is okay in my book because steam was the OG 2FA provider. They forced 2FA on everyone, all the way back in 2007, they took security seriously before anyone else really cared. So, they're grandfathered in.
load more comments
(3 replies)
If you're rooted, Aegis can import the seed from the Steam app then you don't need it anymore.
Oh, that's awesome!
But I don't have root
You may be able to use an older version of the app that allowed ADB backups, and extract the seed from that.
Another approach is to extract it from the Steam desktop app.
No idea what companies think they're accomplishing by using non-standard TOTP apps (that actually do TOTP under the hood). Microsoft do it so they can track your location and report it to managers when you login because it's something that management asks for. Some companies do it so they can lock you into their services. No idea why Steam does it.
load more comments
(2 replies)
load more comments
(2 replies)
load more comments
(1 replies)
Exactly. At the end of the day there’s nothing being transmitted with OTP and using a standard app isn’t an issue.
Or like eBay
load more comments
(6 replies)
SMS is the least secure form of 2FA, and sim swaps are a very real thing. Whatever you're issues with 2FA apps are, I can 100% say that you should be more concerned about actors getting access to your account.
And this isn't just GitHub. You should be using a 2FA app for allllll of your services. Breaches are a daily thing, your passwords are online and are available. 2FA may be the only thing defending you right now, and SMS 2fa or email 2fa I wouldn't trust.
Totally agree! 2FA on all the accounts that support it avoiding SMS. And different passwords (complex, auto generated by a password manager) for each single account. I may be paranoid, but I also use a different email alias (SimpleLogin) for every single account! 😆
same, a simple habit that is secure, I use it always with maximum privacy. One day you will be in a rush, under stress, affected by age, and use your old habits with a valuable asset...
load more comments
(1 replies)
If you're not already using 2fa everywhere you can, you're already doing it wrong.
load more comments
(14 replies)
You can try aegis if you're on Android, open source, local, great
Also OTPclient on desktop, it can work directly with an Aegis encrypted export file. You enter the decrypt password when you open the app and it can auto-lock after a specified interval.
load more comments
(2 replies)
load more comments
(2 replies)
I just use Bitwarden's 2FA functionality.
This is premium functionality, for those who don't know.
They have a free application too:
https://play.google.com/store/apps/details?id=com.bitwarden.authenticator
load more comments
(2 replies)
load more comments
(3 replies)
Aegis
Yubikey, but thats just a personal preference. A password manager works just as well.
load more comments
(1 replies)
I use keepassxc to generate the code.
Agreed, me to! And I use syncthing to sync my database between my devices Edit: mine is called KeePassDX but its the same database file
I already use pass ("the unix password manager") and there's a pretty decent extension that lets it handle 2fa: https://github.com/tadfisher/pass-otp
Worth noting that this somewhat defeats the purpose of 2fa if you put your GitHub password in the same store as the one used for otp. Nevertheless, this let's me sign on to 2fa services from the command line without purchasing a USB dongle or needing a smartphone on-hand.
Your two factors shift to possession of your password vault + knowledge of the password to it. You're okay IMO.
You also still get the anti-replay benefits of the OTPs, though that might be a bit moot with TLS everywhere.
load more comments
(1 replies)
It's fine. I moved to gitlab years ago for 2fa, so while this doesn't affect me I would be entirely ok with normal 2fa.
It is normal, right? Not a weird Microsoft 2fa requiring their app?
Yes you can use any app, it's standard TOTP.
load more comments
(1 replies)
I don’t love the idea of having an authenticator app installed on my phone
For anything? Why not? Surely you don't believe SMS-based TOTP is safer, right?
load more comments
(7 replies)
Ideally you don’t want to build your open source software on a proprietary forge service so hopefully nothing of value is on the Microsoft-owned platform so it doesn’t really matter how secure it is.
But you should have a free software TOTP option on you anyhow. I use password-store’s OTP plugin so it is easier to back up & sync.
Did you forget the ./s or something? Lemmy itself is developed on GitHub, as are plenty of other "valuable" open source projects. To pretend nothing of value is built there is putting your head in the sand.
If you're developing software on GitHub you have a chance at getting some useful feedback, bug reports and maybe even PRs. Like it or not, the network effect is real.
load more comments
(1 replies)
Its more secure and ssh keys are more convenient anyways
I just use my password manager to generate the TOTP. There's no way I'm going to install an app just to use a website.
This hate for 2FA is bizarre to me. Sure, it's not as convenient but in this day and age, with all the threats out there, there's no real excuse for not using it.
I generate a TOTP with my password manager, it stores all my other login details and keeps it simple.
load more comments
(9 replies)
Codeberg, or failing that, GitLab, or BitBucket. Allowing MS to control all FLOSS software, means they might probably secretly get consent to use your code for copilot training without respecting licences. I have no idea if this happens, or might in the future, as I ain't reading the terms of service for something I do not use, however, I have little trust for them enough for air on the side of caution.
I'm gonna keep putting all of my code on github, then. Doing my part to make copilot crash and burn.
load more comments
(1 replies)
I have a dedicated phone with a dedicated number which stays at home all the time. Call it (see what I did there) the Authenticator phone, which only job is to authenticate me when needed. Not only for Github, but other services too. Minimizing the risk to lose or break the device. And companies don't get all my private stuff.
load more comments
(4 replies)
pass otp. Works, more secure then SMS, open source.
iCloud Keychain. Has the ability to store 2FA codes and pull them up automatically. GitHub also supports passkeys so most times I just log in with my biometrics or user pass and don’t have to worry about the added layer.
I’m fine with regular 2FA. What I can’t abide is having to use proprietary apps, like Blizzard’s battle net. Steam too.
Passkeys are the future but still a ways off.
Wild tho that you don’t have any other accounts needing 2FA? That’s scary to me as that added security goes a long ass way in regards to hardening your secuity.
last time I signed into my Microsoft 365 account for work I got two separate 2fa prompts and two captchas, it was like being in an episode of the crystal maze. the mere act of signing into something is now tedious and difficult
view more: next ›