GitHub now requiring 2FA for all contributors,what authenticator apps you using?

6 days ago

GitHub is rolling out mandatory 2FA for accounts that contribute code, with a 45-day window to enroll.

Aegis, Raivo, or Ente are the ones that have most promise from what I've read. Any other recommendations? or thoughts on those three in particular.

TY

41 comments

nickcageinacage

Reply
Areena_28  1 day ago

Been using Aegis for a while now, the encrypted backup alone makes it worth it over Google Authenticator. losing access to everything because you switched phones once is enough to make you take backups seriously. Ente is worth a look if you want cloud sync without giving up control of your keys. haven't tried Raivo personally.

6272connect  4 days ago

Aegis is a solid choice for local 2FA, especially if you're looking for something actively maintained that doesn't rely on cloud sync. Several comments like uyzstvqs and gethly point this out, and I've seen it perform well in practice. For the absolute highest security tiers, though, consider moving towards hardware keys. While it adds a bit more friction than an app, the security posture is far superior for critical accounts.

jjgreen  6 days ago

That's been pending for a while, I'll just stop contributing code.

  • nextos  6 days ago

    You don't need an app if you don't want one.

    In a CLI, oath lets you calculate a TOTP.

    But it's maybe a bit more insecure if you use the same machine.

  • codazoda  6 days ago

    Why? You’re against 2FA? You couldn’t contribute without an account before, could you?

    • jjgreen  5 days ago

      I'd had a GH account for ages under my own name, I closed that as soon as Microsoft took it over, moved all my repos to GitLab, good move. I opened a new GH account under a silly name [1] so I could collaborate with people still on it. Now I'm not really against 2FA, but don't use it myself, it adds friction, adds risk (what if you lose it), it seems too "theatrical" for my liking. You want to use 2FA? be my guest, live and let live etc. What I don't like is being told what to do with my account, particularly by someone like MicroSlop. I won't add 2FA to my GH account, so I'll not contribute any code to GH based projects, ho hum. As I understand it, I'll still be able to raise issues without 2FA, fine, and when 2FA becomes mandatory for that, I'll stop doing that too.

      [1] https://github.com/noproblemwiththat

      2 replies →

gethly  4 days ago

There has been a review of these apps some time ago. I know google/ms were worst and Aegis was on the top of the list(among few others whom i do not remember). I have been using Aegis for aeges :D

bjourne  6 days ago

Microsoft showing 2FA down everyone's throat is quite painful. I don't for a second believe they are only using my phone number for authentication. They are storing the data and they are correlating it with other apps they force 2FA on.

  • stephenr  6 days ago

    So don't give them your phone number.

    Arguing against 2FA is like arguing that they shouldn't bash your password because it means you can't see your password to help remember it.

anshik1998  4 days ago

Google Authenticator. Surely I can look for something better but why to complicate things and spend time searching for better alternatives.

codazoda  6 days ago

Authy but I’m considering moving to Apple Passwords so it’s all together.

  • ecesena  5 days ago

    Same. To add some details, I used Authy because at the time it was the only app that would just work after upgrading my iphone. I never enabled their cloud mode, so only local 2FA codes.

grahammccain  5 days ago

I only use google and Microsoft, it might be a good idea for me to look into this deeper for the future.

threecheese  6 days ago

Using GitHub MFA via the app on my iPhone.