two-factor authentication
4 articles with this tag
Setting up GitHub two-factor authentication (2FA): authenticator app, passkeys, recovery codes, and what to do if you lose your phone
A guide to setting up two-factor authentication (2FA) on GitHub and avoiding lockout. Since March 2023, GitHub has been requiring 2FA, group by group, for users who contribute code on GitHub.com; once selected, you get a 45-day enrollment period and a 7-day grace period, after which you cannot use GitHub.com until 2FA is on. GitHub Docs recommends a TOTP authenticator app as the primary method with a passkey or security key as backup (passkeys, security keys and GitHub Mobile can only be added after TOTP or SMS is set up). This site's take: the common 2FA failure on GitHub is not account takeover but locking yourself out, and GitHub Support cannot restore an account whose 2FA credentials and recovery methods are all lost. Save the 16 recovery codes in a password manager and register a second method on the same day. While you are there, move to expiring fine-grained tokens, prune authorized apps and SSH keys, and check push protection and Dependabot alerts.
7pay fraud (2019): the disclosed cause assessment and account protections
7pay suffered unauthorized account access in July 2019. The August 1 company statement assessed credential stuffing as likely and recorded 808 affected people and ¥38,615,473 as of July 31 at 17:00, including unauthorized top-ups and use. It had not found cases where reset functions were a direct cause. Separate that assessment from general advice on authentication, recovery and alerts.
What is a one-time password (OTP)? TOTP vs HOTP vs SMS, and its limits
A one-time password (OTP) is a short-lived, single-use code that becomes invalid once used. Types: authenticator-app TOTP (time-based), HOTP (counter-based), and SMS-OTP. It's strong against leaked and reused passwords and is commonly the 'something you have' factor in 2FA. But it has a limit: adversary-in-the-middle (AiTM) phishing can relay an OTP through a fake site and still get in. Strong phishing resistance comes from a domain-bound passkey. OTP is 'much better than nothing, but not the final step.'
What is two-factor authentication (2FA)? vs two-step, and the strength of each method
Two-factor authentication (2FA) strengthens identity checks by adding a different category of proof — 'something you have' or 'something you are' (a code, key, or biometric) — on top of 'something you know' (your password). It is strictly not the same as two-step verification (two checks, not necessarily two categories). Strength depends on the method: SMS/email < authenticator app (TOTP) < passkey/security key (FIDO2). This site's stance: turn on some 2FA everywhere first, then move key accounts to methods you can't hand to a phishing site.