GitHub rolling out two-factor authentication to millions of users

Over the next nine months, the largest internet hosting service for software development and collaboration will make all code contributors add another layer of electronic evidence to their accounts.

GitHub, used by the majority of major tech companies, has announced that it is rolling out 2FA. Acknowledging supply chain security risks, which have been on the rise, the company starts a nine-month rollout on Monday, March 13. All developers who contribute code on the platform will eventually have to adopt the security protocol, the company announced on Thursday.

SEE: Hiring kit: Full stack developer (TechRepublic Premium)

The Microsoft-owned DevOps service said the move aligns with the National Cybersecurity Strategy, which, among other things, puts the onus and more security responsibility on software vendors.

Jump to:

Being a developer doesn’t make you invulnerable

Even developers make mistakes and can become victims of security breaches. Mike Hanley, chief security officer and senior vice president of engineering at GitHub, wrote in a May 2022 blog — which mentioned the 2FA plan for the first time — that compromised accounts can be used to steal private code or push malicious changes to that code.

“This places not only the individuals and organizations associated with the compromised accounts at risk, but also any users of the affected code,” he wrote. “The potential for downstream impact to the broader software ecosystem and supply chain as a result is substantial.”

SEE: How to minimize security risks: Follow these best practices for success (TechRepublic Premium)

Different 2FA choices, but biometrics and passkeys trump SMS

GitHub is also offering a preferred 2FA option for account login with a sudo prompt, allowing users to choose between time-based one-time passwords, SMS, security keys or GitHub Mobile. However, the company is urging users to go with security keys and TOTPs, noting that SMS-based 2FA is less secure.

NIST, which no longer recommends 2FA, pointed out that:

• An out-of-band secret sent via SMS can be received by an attacker who has convinced the mobile operator to redirect the victim’s mobile phone to the attacker.
• A malicious app on the endpoint can read an out-of-band secret sent via SMS and the attacker can use the secret to authenticate.

“The strongest methods widely available are those that support the WebAuthn secure authentication standard,” said GitHub in its announcement. “These methods include physical security keys as well as personal devices that support technologies such as Windows Hello or Face ID/Touch ID.”

SEE: 1Password is looking to a password-free future. Here’s why (TechRepublic)

GitHub said it is also testing passkeys, the next-generation credential protocol, as a defense against exploits like phishing.

“Because passkeys are still a newer authentication method, we’re working to test them internally before we roll them out to customers,” said a spokesperson. “We believe they’ll combine ease of use with strong and phishing-resistant authentication.”

Latest move follows cadence of GitHub security programs

In a move toward closing loopholes to combat threat actors, GitHub expanded its secret scanning program last fall, allowing developers to track any publicly exposed secrets in their public GitHub repository.

And earlier this year, GitHub launched a setup option for code scanning called “default setup” that lets users automatically enable code scanning.

“Our 2FA initiative is part of a platform-wide effort to secure software development by improving account security,” the company said in a release, noting that developer accounts are social engineering and account takeover targets.

Months-long rollout to minimize disruption, optimize protocols

The process for disseminating the new protocols is meant to minimize disruption to users, with groups selected based on the actions they’ve taken or the code they’ve contributed to, according to GitHub (Figure A).

Figure A

The company said the slow rollout would also make it easier for GitHub to make adjustments as needed before scaling to larger and larger groups over the course of this year.

A spokesperson for GitHub explained that, while the company won’t offer specifics on how users qualify for being part of certain groups in the 2FA cadence, the person did say groups are determined, in part, based on their impact on the security of the broader ecosystem. High-impact groups will include users who:

• Published GitHub or OAuth apps, Actions or packages.
• Created a release.
• Contributed code to repositories deemed critical by npm, OpenSSF, PyPI or RubyGems.
• Contributed code to any of the approximate top four million public and private repositories.
• Act as enterprise and organization administrators.

For those with a proactive bent, the company is offering 2FA immediately at a dedicated site.

GitHub offers developers 2FA timeline

The process for GitHub contributors sets several time markers for initiating 2FA around a soft deadline (Figure B).

Figure B

Before the deadline

GitHub contributors selected for a pending 2FA group will get advance notification by email 45 days before the deadline, informing them of the deadline and offering guidance on how to enable 2FA.

Once the enablement deadline passes

Those notified will be prompted to enable 2FA the first time they access GitHub.com each day. They can snooze this prompt once a day for up to one week, but after that, they will be unable to access GitHub.com features until they enable 2FA.

28 days after 2FA is enabled

Users will receive a 2FA “check-up” while using GitHub.com, which validates that their 2FA setup is working correctly. Previously signed-in users will be able to reconfigure 2FA if they have misconfigured or misplaced second factors or recovery codes during onboarding.

Email flexibility to avoid lockout

Fortunately, the new protocols let users unlink email from a 2FA-enabled GitHub account to avoid the paradox of being locked out of the very thing — email — that allows them to verify the account if they’re unable to sign in or recover it.

“If you’re unable to find an SSH key, PAT, or a device that’s been previously signed into GitHub to recover your account, it’s easy to start fresh with a new GitHub.com account and keep that contribution graph rightfully green,” said the company.