Seriously though, if using a TOTP generator or physical security key is a "burden" for someone, I really doubt they're the target audience for GitHub.
The benefits of 2FA are well known, and even if you have to enter the code manually (ie no browser integration) it's still arguably several orders of magnitude simpler in concept than most git operations.
Also phones don’t seem to think it’s important to backup 2FA secrets so when you move devices you’re out of luck.
Why doesn't your organisation have at least two people with the Owner role?
> Also phones don’t seem to think it’s important to backup 2FA secrets
I've been using a TOTP app with backup functionality since at least 2014, so its not exactly a new concept. If you choose not to avail yourself of one, that's on you.
It's simple, just never make any mistakes.
> I've been using a TOTP app with backup functionality since at least 2014, so its not exactly a new concept. If you choose not to avail yourself of one, that's on you.
You're right! how dare they not know everything that you know.... it's insane that someone might not do everything exactly the way you think it should be done!
I get that's not what you're trying to say, but all you're doing is blaming humans for ignorance, or making mistakes. I'd assert, that given you clearly understand both security, and best practices, you'd be better equipped to help offer solutions instead of accusations, or blame.
I really do have to wonder about the people who realised it's a problem to have no easy to use backup, but then apparently spent exactly zero minutes to try and find a solution.
So? It's not like shitty Samsung refrigerators is the only one model available.
I really do have to wonder about people who choose refrigerators using R407c refrigerant where temperature glide causes compressor valves to wear out prematurely. People apparently spent exactly zero minutes to try and find a solution.
You clearly didn't understand the point I'm making so let me be more explicit: I don't expect people to know everything. As you allude to, it's impossible to know everything.
What I do expect, is for people to learn and try to resolve problems they face, rather than just sticking their head in the sand and pretending there's nothing they can do.
A more accurate analogy using your fridge example would be:
Johnny buys a POS Samsung fridge.
Unknown to Johnny, Samsung fridges use R407c refrigerant which causes the compressor valves to wear out prematurely. The compressor on his fridge needs to be replaced after just 3 years of use.
Rather than asking others for advice on the issue, Johnny now tells anyone that will listen, that all fridges will all need their compressor replaced after 3 years.
That's what's happening in this thread: zero requests for information or help about the issue; multiple posts claiming things that are factually incorrect, with absolute confidence.
What "organization" only has one person with access to the repositories?
These hypotheticals become goofier with each iteration
Many small organisations may only have one person with an Owner account for the very reason that they don’t _need_ to have multiple people with access to that account as you share out access to repositories to team members that have less privileged accounts.
It is much “goofier” to assume that every organisation using Github has two people that have been granted an “Owner” level account.
Once you pass from single user to "organization", multiple "ownership" is du jour
Maybe there are some out there - but they're stupid, if they are