Hacker News Reader

Comment by _fat_santa | Hacker News Reader

Anyone that uses Github day to day at work and for side projects should have already enabled it.

When I think of what the "most important" account is to me, my Github page is pretty damn close to the top. Mine is currently 2FA with an automated script that will scan my Github and back everything up to GitLab (at least the "important" projects), which is also 2FA'd.

Insane setup to protect data in one account but if I loose access it would be beyond a bad day for me.

View on HN

Am I the only one that thinks that 2FA actually increases the probability of losing access to an account? It's only a matter of losing the 2nd factor.

Github has alternative recovery methods though too, such as 2FA over SMS.

And support can help out as long as you can show that you can ssh into a github host using the private key of one of the public ssh keys assigned to your account.

That makes some sense, and seems to me a nice option. Is it documented anywhere that that is an option, that they will do that?

Documented here:

https://docs.github.com/en/authentication/securing-your-acco...

easily solved by adding multiple MFA options, e.g. multiple security keys.

For that there are the revoke code. And the backup phone number.

Or even better than the one time codes they give you, you can simply store the secret itself, on a piece of paper in a safe.

What people should do is have a small SD card with all of their private keys and passwords stored away safely. This SD card should be kept in cold storage (e.g. in a safe where you keep personal belongings), and never be accessed unless in absolute emergency (lost your YubiKey etc and can't get in anywhere, etc.)

SD cards are horrendous for long term storage. Probably the worst medium for such a task.

What is the best? Cursory googling suggests SD cards last ~decades at normal usage [0], and in this context where it's barely accessed, maybe longer?

[0] https://www.sdcard.org/consumers/faq

If you go to bluray.com you probably can read the same only for blu-ray.

Better search for a neutral source.

I wrote some scripts to generate QR codes, then printed them to photo paper.

https://github.com/alexjh/gpg-backup/blob/master/Makefile

Back then I thought that QR codes were a bit of a gimmick but now I'm way more confident that I'll be able to read them in the future.

laser print

Probably depends on the quantity of data. If you're talking GB's or TB's of digital data, then maybe "archival grade" DVD's or BluRay's.

https://www.verbatim.com.au/product-category/data-storage/op...

If it's instead just a few short strings of text (eg GH password recovery codes), then you could use physical storage.

eg engrave the codes into something that'll survive extremes (granite?), and keep them in a fire proof safe.

Or something along similar lines. Probably don't engrave into glass though, due to that potentially shattering in some situations.

My choice are 8cm DVDs of decent quality. And inability to quickly overwrite/damage your data is a bonus.

Do most people have a "safe where they keep their personal belongings"?

i guess it would presumably be on-premises, because you're going to have to take it out to add recovery codes to it every time you add a new TOTP or whatever (or create a new private key or password) right? If it was, say, a safety deposit box at a bank, odds are it's not gonna wind up with most of your stuff. Even on-premises, the task of making sure "cold storage" stays sync'd with my evolving passwords, private keys, TOTP recovery codes, etc, seems like something I'm unlikely to keep up with.

I have an IronKey for this purpose.

You can have multiple second factors. I have 2 YubiKeys (one on me, one in a safe place) and then I have the standard TOTP codes on my phone using Authy.

If I manage to lose my phone, live and backup yubikeys then I have recovery codes.

It's going to have to be something pretty drastic to cause me to loose all of that.

Well, I've lost control of accounts and I suspect a few of us have. Fortunately the one I lost wasn't important.

But my response wasn't to turn off 2FA. It was the reverse - to turn on all forms of authentication made available, for all acccouts. If I lost control of it one way, I had another.

By the by, if you read the spec, FIDO expects you to do this in preparation for the day you lose your token. So no you are not the only one - people think about it all the time.

No, we're here with you. I'm also wondering if being responsible for storing and using passwords is THAT BIG OF A DEAL??? Even mathematically, probabilities of two failing points are adding. I've been locked away from mail, banks and gods know what else just because I didn't have my phone or computer nearby, was in different country, in a place without network coverage, haven't paid for cell in time, etc. etc. etc. and absolutely positive that 2FA (at least that requiring on-line presence) is evil. The ONLY THING that can really protect and help you - is good HUMAN tech support. Where you can call, explain yourself, prove ownership and regain access to a service. Up to the point of having to go to of video-call office yourself and beyond. Yeah, I'm completely aware that some corporations don't even have humans (hello, Goolag!) employed - and trying to stay clear from them.

I just use different accounts for work and private stuff.

For me 2FA is super annoying because I run my browsers in private mode and I restart them multiple times a day, so I have to sign in quite often. It effectively makes it much harder for me to keep my privacy.

Not to mention loosing the freedom to log in to my accounts from everywhere without needing my devices. Things do get stolen/lost/destroyed and that is a more realistic threat for me than getting my password stolen.

I don’t think that’s an insane setup at all. Losing access to GitHub would be bad for a lot of folks on HN I suspect. My GitHub has 2FA with Yubikeys and I am planning to do something similar to yours with backing up to a personal Gitea instance… once I get around to it.

Meanwhile, some use github once a year to file a bug report against an OSS project.

Tiered access would be better here. No commits, repos without 2fa.

It's clear in the article's title, subtitle, first paragraph and bold quote thing that this does not affect someone handling issues and not code.

The post is talking about 2FA for

> active contributors (for example, those who commit code, open or merge pull requests, use Actions, or publish packages)

So it may not be required to simply file a bug report.

Nit pick, but I wanted to point out that backing up your cloud data (github) to another cloud (gitlab) is increasing (approximately doubling) your attack surface. Good for data retention though.

This assumes that the "attacks" you're concerned with preventing are exfiltration of data, rather than mutation/deletion of data.

Would you be able to share the GitHub to GitLab backup script?

Reply on news.ycombinator.com