this post was submitted on 05 Jun 2024
35 points (100.0% liked)

Open Source

823 readers
20 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
 

Just wondering what people are using to meet the 2FA requirement GitHub has been rolling out. I don't love the idea of having an authenticator app installed on my phone just to log into GitHub. And really don't want to give them my phone number just to log in.

Last year, we announced our commitment to require all developers who contribute code on GitHub.com to enable two-factor authentication (2FA)...

you are viewing a single comment's thread
view the rest of the comments
[–] delirious_owl@discuss.online 2 points 5 months ago (1 children)

The point of being time based is to not send it. That's the whole point. To avoid that vecotor of attack.

[–] Dymonika 2 points 5 months ago (1 children)

Do you think the SMS codes are not time-based on the companies' ends? How are they deriving the digits, then?

[–] delirious_owl@discuss.online 2 points 5 months ago (1 children)

They are not time based, correct.

[–] Dymonika 2 points 5 months ago* (last edited 5 months ago) (1 children)

Interesting, I didn't know that. So how do they derive the digits?

[–] delirious_owl@discuss.online 2 points 5 months ago* (last edited 5 months ago)

Best practice for a cryptographic nonce is to generate them randomly every time