SoylentNews

GitHub to Require Two Factor Authentication for Code Contributors by Late 2023

posted by janrinok on Friday May 06 2022, @01:47PM   

An Anonymous Coward writes:

Code locker has figured out it's a giant honeypot for miscreants planning supply chain attacks

GitHub has announced that it will require two factor authentication for users who contribute code on its service.

"The software supply chain starts with the developer," wrote GitHub chief security officer Mike Hanley on the company blog. "Developer accounts are frequent targets for social engineering and account takeover, and protecting developers from these types of attacks is the first and most critical step toward securing the supply chain."

Readers will doubtless recall that attacks on development supply chains have recently proven extremely nasty. Exhibit A: the Russian operatives that slipped malware into SolarWinds' Orion monitoring tool and used it to gain access to over 18,000 companies. GitHub has also had its own problems, such as when access to npm was compromised.

Hence its decision to require 2FA "by the end of 2023" for users who commit code, open or merge pull requests, use Actions, or publish packages. GitHub already offers 2FA, requires contributors of popular packages (including npm) to employ it, and states that 16.5 per cent of active users already employ the technique.

---

Original Submission

• Re:Sweet Re:Sweet (Score: 3, Touché) by FatPhil on Saturday May 07 2022, @12:31PM (1 child)

  by FatPhil (863) <reversethis-{if.fdsa} {ta} {tnelyos-cp}> on Saturday May 07 2022, @12:31PM (#1242981) Homepage

  git am
  
  No patch required, no fiddling required.

  --
  Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves

  Parent

  Starting Score:	1		point
  Moderation		+1
  Touché=1, Total=1
  Extra 'Touché' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		3

• Re:Sweet (Score: 2) by lentilla on Sunday May 08 2022, @10:23PM

  by lentilla (1770) on Sunday May 08 2022, @10:23PM (#1243297)

  I had forgotten about that - thanks!

  I went and read the manpage and this would fit easily into my workflow: sync mail using OfflineIMAP, bind a key in mutt (my mail client) to pipe the email to git-am, and we are off to the races. Ironically; and currently sitting in my too-hard basket; is that a number of my "corporate" email accounts require some kind of multi-factor magic to access, so I'm stuck using the web-client. Ironic because github wants 2FA, so the workaround is "use email", which requires 2FA. Why can't they just leave us alone? (Yes - I know why - doesn't mean I'm happy about it.)

  Thanks again for the pointer. git is truly an awesome tool.

  Parent