[Archive] Enforcement of secure two-factor methods only

[Managor]

One hour ago @sebastiaanspeck enabled usage of secure two-factor methods only. This had the unfortunate side effect of kicking any outside collaborators or organization members from the project who were using SMS as a 2FA method.

Note

GitHub recommended secure methods include any authenticator app (we suggest using a cloud synced authenticator app, to prevent losing the TOTP keys when changing the device in future), passkeys or other secure keys, GitHub mobile app.

Chime in this thread once you've removed sms two-factor from your account and me or some other organisation admin will invite you back.

@TheRootDaemon @CodePsy-2001 @badhon495 @CairnThePerson @korECM @quantumflo @karthik-script @noraj @znarfm @reinhart1010 @msaf9 @aherst @ivanhercaz @Nico385412 @IMHOJEONG @jeeftor @Aracki @glenacota @igorshubovych @AnimiVulpis @felixonmars

[badhon495]

Got the invite.
Thank you.

[znarfm]

I got the option removed now.

[msaf9]

I disabled SMS as my 2FA method. Thank you!

[kbdharun]

Adding related chatroom discussion for future reference: https://matrix.to/#/!zXiOpjSkFTvtMpsenJ:gitter.im/$Ys90LOoiYwBj8fK70ynshdvhnNWFpk9-55rQXbY64f8?via=gitter.im&via=matrix.org&via=one.ems.host

And also my comment from there:

In India, a phone number is rotated and allocated to a new user, after 3 months if the current owner stops paying/recharging for it. And all authentication, accounts, etc is done via OTP or associated with the phone number. So it's a huge attack vector, since the new user getting the recycled number will have access to all the previous owner's services.

So GitHub has been recommending for a while to not use this option, since the change is already done and it's more secure, let's not revert it and instead as Managor suggested let's invite the removed members post disabling SMS auth.

[Aracki]

I disabled SMS as my 2FA method as well.

Thanks for notification, didn't even know SMS was completely insecure and not recommended.

[TheRootDaemon]

I disabled it, Thank you for the info.

[noraj]

✔️ Could you add me back? #12331 (comment)