Mandatory 2fa

[chedim]

Select Topic Area

Question

Body

Got the message about mandatory two-factor authentication. How can I exclude my profile from that without moving to self-hosted git server?

[meppu]

From GitHub 2FA Documentation

Starting in March 2023 and through the end of 2023, GitHub will gradually begin to require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA). If you are in an eligible group, you will receive a notification email when that group is selected for enrollment, marking the beginning of a 45-day 2FA enrollment period, and you will see banners asking you to enroll in 2FA on GitHub.com. If you don't receive a notification, then you are not part of a group required to enable 2FA, though we strongly recommend it.

And from their blog

Protecting developers and consumers of the open source ecosystem from these types of attacks is the first and most critical step toward securing the supply chain.

1. If you are part of a pending 2FA enablement group, you will receive notification by email informing you of your deadline to enable 2FA, as well as information on how to set up 2FA and our recommended best practices. You’ll get this email approximately 45 days before the deadline.

• When your group’s timeline begins, you’ll start seeing weekly reminder banners on GitHub.com, which will also guide you to the 2FA onboarding process.

• You’ll also receive occasional emails notifying you of your coming 2FA enablement deadline.

2. Once the enablement deadline passes, you’ll be asked to enable 2FA the first time you access GitHub.com each day. You can snooze this prompt once a day for up to one week to provide you with flexibility, but after that week you won’t be able to access GitHub.com until you’ve enabled 2FA.

• This one week snooze period only starts when you access GitHub after the deadline, so if you’re on vacation, don’t worry–you won’t be locked out of GitHub.com.

3. Twenty-eight (28) days after you enable 2FA, you’ll be asked to perform a 2FA check-up while using GitHub.com, which validates that your 2FA setup is working correctly. Previously signed-in users will be able to reconfigure 2FA if they have misconfigured or misplaced second factors during onboarding.

Most importantly, though, we can’t improve the security of the software supply chain without you. We thank you in advance for your support, and for enrolling your GitHub account in 2FA to make open source software more secure for all.

So, you should NOT exclude your profile from enroll, You can choose between TOTP, SMS, security keys, or GitHub Mobile as your preferred 2FA.

[ghost]

No, obviously the correct course of action is to give Microsoft all of your personally identifying information so they can sell it to the highest bidder.

[ghost]

I'm right here with you. I'm moving to another git provider because I don't trust Microsoft, with their notoriously terrible track record protecting user privacy, with access to my mobile device, nor my phone number.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬