GitHub to require two factor authentication for code contributors by late 2023
- Reference: 1651723273
- News link: https://www.theregister.co.uk/2022/05/05/github_2fa_mandatory_2023/
- Source link:
"The software supply chain starts with the developer," [1]wrote GitHub chief security officer Mike Hanley on the company blog. "Developer accounts are frequent targets for social engineering and account takeover, and protecting developers from these types of attacks is the first and most critical step toward securing the supply chain."
Readers will doubtless recall that attacks on development supply chains have recently proven extremely nasty. Exhibit A: the Russian operatives that [2]slipped malware into SolarWinds' Orion monitoring tool and used it to gain access to over 18,000 companies. GitHub has also had its own problems, such as when [3]access to npm was compromised.
[4]
Hence its decision to require 2FA "by the end of 2023" for users who commit code, open or merge pull requests, use Actions, or publish packages.
[5]Microsoft reanimates 1995's 3D Movie Maker via GitHub
[6]So, what happened with GitHub, Heroku, and those raided private repos?
[7]GitHub's Dependabot learns to report bad news you can use
GitHub already offers 2FA, requires contributors of popular packages (including npm) to employ it, and states that 16.5 per cent of active users already employ the technique.
Why the rest have until sometime in 2023 to adopt 2FA isn't explained in Hanley's post, beyond his assertion that "GitHub is committed to making sure that strong account security doesn't come at the expense of a great experience for developers, and our end of 2023 target gives us the opportunity to optimize for this."
[8]
The post also states that GitHub will "actively explore new ways of securely authenticating users" and add more ways to recover accounts.
"Improvements that help prevent and recover from account compromise" are also on the agenda.
[9]
Hanley's post states that details of GitHub's 2FA implementation will emerge in "coming months". ®
Get our [10]Tech Resources
[1] https://github.blog/2022-05-04-software-security-starts-with-the-developer-securing-developer-accounts-with-2fa/
[2] https://www.theregister.com/2021/09/02/autodesk_solarwinds_hack_victim/
[3] https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YnOgTW6lQ8eRAXVi-ULW5QAAAIY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2022/05/04/3d_movie_make/
[6] https://www.theregister.com/2022/04/21/github-stolen-oauth-tokens-used-in-breaches/
[7] https://www.theregister.com/2022/04/15/githubs_dependabot_security/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YnOgTW6lQ8eRAXVi-ULW5QAAAIY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YnOgTW6lQ8eRAXVi-ULW5QAAAIY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Re: I wonder
Other public source code repositories, not owned by M$, are available.
Re: I wonder
It depends on the MFA implementation. But now seeing it is Microsoft, they'll use their own app.
If it was based on standard TOTP, then there's no data to mine.
Re: I wonder
> But now seeing it is Microsoft, they'll use their own app.
>
> If it was based on standard TOTP, then there's no data to mine.
Last I checked, Microsoft Authenticator *is* TOTP based, so you can easily use Authy, Google Authenticator or a python script instead.
Github don't just support TOTP 2FA anyway - I use a U2F key as a second factor, with TOTP set up as a fallback
Microsoft would have to scrap an awful lot of the existing 2FA implementation to turn it into a data mining operation.
I'm all for cynicism, especially about data collection, but this isn't one of those times
by the end of 2023
Well that's a cool 19 months away.
Couldn't they make it optional a wee bit sooner ?
Re: by the end of 2023
Give them a break, now they have made the announcement they need to figure out the best way of making an obscene profit from this.
Re: by the end of 2023
It already is optional, you can setup 2FA on your account now and have been able to for ages.
What doesn't currently exist, is an option on a repo to say "collaborators must have 2FA enabled"
Re: by the end of 2023
If they did that they would have to extend the deadline sooner!
Just remember to [1]keep those one-time codes to yourself .
[1] https://xkcd.com/2543/
Git is distibuted, so I hear
Learn to use SSH and host your own stuff securely, you don't need to rely on third parties!
Re: Git is distibuted, so I hear
There's much, much, much more to Github than just repo hosting.
The interface provides project management, CI etc etc etc.
But, the biggest reason for using Github tends to be discoverability - unless you're already a big project, you'll likely get much more use and many more contributors by being on Github. Especially for small drive-by fixes (almost no-one's going to create an account on your server to fix a small UI bug, but they might chuck a quick pull request, or at least an issue report in on Github).
Although it's not generally what you think of as social media, it has many of the same effects - you derive some benefit from being where the users are.
I host my own git repos for various things, but it really is an incomplete alternative for many projects.
I wonder
I'm not saying that the extra data mining information harvested from 2FA is not beneficial to Microsoft (the telemetry company), but I do wonder how many projects will delete everything from github and move elsewhere.