GitHub Community
Erroneous GitHub warning messages about Multi-Factor Authentication #129244
-
Select Topic AreaBug BodyGitHub has begun showing me a yellow warning message which says:
In addition, I see the following warning message in the Password and authentication tab:
Contrary to the above messages, I do not have SMS-based authentication enabled for my account, let alone as the sole second-factor authentication method. First, SMS-based authentication is disabled. Second, I have code-based MFA enabled, which is a widely-supported open standard, as well as the security codes provided by GitHub. Taken together, this security message is misleading, and may lead to some users becoming confused and inadvertently weakening their security practices. It is also possible that there could be a bug here, causing the message to not be shown to users who have SMS-based authentication enabled. |
Beta Was this translation helpful? Give feedback.
Replies: 10 comments 27 replies
-
|
This message is really pissing me off. I should not have to constantly see a misleading warning about not having enough 2FA methods. I have ONE and I only want ONE. I do NOT want there to ever be ANY other method that a hacker can use to bypass my 2FA. there is ZERO chance that I will lose access to my authenticator keys. and if I did I'd also have to have permanently lost access to my bitwarden password manager which at that point, GitHub is the least of my worries for the things that I will never be able to access again. GitHub: Don't tell me I need to lessen my security. I chose a method, and only that method, fully aware of the implications involved if I were to ever be stupid enough to lose those values. |
Beta Was this translation helpful? Give feedback.
-
|
At least make the message go away forever when I dismiss it... |
Beta Was this translation helpful? Give feedback.
-
|
Hi @cosmic-linden , Yes, the warning statement can be misleading because it actually refers that you should have more than one 2FA method enabled and avoid SMS authentication. The warning goes away if you add another 2FA method (even SMS), I've tested it yesterday. See this discussion #129189 |
Beta Was this translation helpful? Give feedback.
-
|
But this makes no sense if I've configured recovery codes already, which is in effect an additional (one-time-use, break-glass) 2FA method keeping me from getting locked out of my account |
Beta Was this translation helpful? Give feedback.
-
|
@poshcodebear The recovery codes don't count as "Preferred 2FA method" which you must set in the settings. |
Beta Was this translation helpful? Give feedback.
-
|
Except I am using an authenticator app, and I have recovery codes, and I'm not using SMS... So the warning makes zero sense |
Beta Was this translation helpful? Give feedback.
-
|
Three-factor authentication? It is getting ridiculous. Surely this must be a bug in the notification system, given two-factor authentication is already enabled by usage of Authenticator app (and not SMS) . |
Beta Was this translation helpful? Give feedback.
-
|
Soon it will be "you may only use Microsoft Authenticator with a default password on Microsoft Windows, for your uuuuuuh... superior security when logging into our Linux servers.". If they really worry about people being locked out, they should just ask for passport or social security numbers and let people regain access in person with biometric checks for an administrative fee of $50. |
Beta Was this translation helpful? Give feedback.
-
|
@Dawoodoz there are enough data breaches involving social insurance numbers that the number would be a horrible way to authenticate someone. The number also isn't tied to your photo so an imposter would just need to discover your number to pass that aspect of authentication. You have to give it to a huge number of people including many government agencies, employers, banks, credit unions, insurance companies, and many databases will keep it. Even if you don't know it was compromised, it most likely was. A passport and its photo matching someone's face and the face stored with the account after would be better. Data breaches and the prevalence of identity theft make it very difficult to authenticate anyone. Sharing a photo of your face with github could be helpful but sharing your social insurance number or passport number would be a serious invasion of privacy and put more of your identity at risk. If you met in person with a passport, driving license or government issued photo ID, they could visually match your face and your passport's photo and compare the names on that ID with the real names in the github account. They could also perform some security checks on the passport and possibly download the associated photo from a government passport database so a fake passport would be discovered. Having prior knowledge of your passport number would be far less helpful than the risk to your identity because anything you expect to happen in person should be with your real government ID anyway. Maintaining a copy of those numbers in github won't help much but would be an extra place where that data could be breached. |
Beta Was this translation helpful? Give feedback.
-
|
@Daoodoz @joshi1983 Joshi1983?? Add 1 onto that number and you get George Orwell. Please do not encourage this bad behaviour. I won't give any identity document to any big tech. That is incredibly naive and a huge persistent risk of identity theft for you. What happens when that big tech service gets hacked? When.. not if. Also, why do they need your passport photo page? Are they going to verify that with the issuing PassPort Authority in Tajikistan? No? Didn't think so. |
Beta Was this translation helpful? Give feedback.
-
|
You don't store it in plain text, only a hash. |
Beta Was this translation helpful? Give feedback.
-
|
@Bob837217 I typed "Sharing a photo of your face with github could be helpful". I didn't say a photo of your passport page. Did you even read my comment? Why did you misread that as a photo of the passport page? I was discouraging sharing of the passport number. I didn't encourage sharing of anything from the passport. I was warning about the same data breach risk you were. A photo of your face could even be a publicly shared photo that github just knows their authenticated user indicated looks like him/her. It is easy to get a photo of you but it can be difficult for an imposter to make their face look like yours if they don't happen to already look a lot like you. Unless you have never talked with a news reporter, kept your photo off your employer's website, keep all your social media private, and all your close friends and family keep their photos with you private, your face is likely a fairly quick search away. I mentioned that they might be able to connect with an official passport database as a way to make sure the passport isn't fake. If they can't do that, they could likely do some checks on the government ID that border security and government agencies do to verify that it isn't fake. The photo of the github user's face compared with the face of the person seeing them in person would mostly authenticate the user regardless of the official government photo ID. The government photo ID shown only in person would just be extra evidence that the names from the github account match the face of the person they're face to face with. |
Beta Was this translation helpful? Give feedback.
-
|
So what do I need to do? |
Beta Was this translation helpful? Give feedback.
-
|
Nothing at all. Looks like a "scare-o-gram" to get you to sign up additionally to GitHub Mobile. Just ignore it. |
Beta Was this translation helpful? Give feedback.
-
|
Feitian |
Beta Was this translation helpful? Give feedback.
-
FIDO IS BEST FOR CYBER SECURITY AWARENESS COMPANIES |
Beta Was this translation helpful? Give feedback.
-
|
This message shows more often on github to people who have 2FA already set up than the Jimmy Wales donate message on Wikipedia. That says a lot. |
Beta Was this translation helpful? Give feedback.
-
|
Well, the line has to go up, doesn't it? Probably need some uBlock Origin rules set up for GitHub.com now to remove offending notifications. |
Beta Was this translation helpful? Give feedback.
-
|
How can I remove this warning, permanently? It's junk. I use an auth app, I am not configuring SMS, and the other two options aren't viable for a sane person. So I have my backup codes as the second. This warning should not be shown and is irresponsible to show it. |
Beta Was this translation helpful? Give feedback.
-
|
You best option is to use uBlock Origin picker and create a rule based on that input. |
Beta Was this translation helpful? Give feedback.
-
|
I would certainly argue that Github should not be displaying erroneous security messages and allow us to dismiss them without resorting to third party tools. |
Beta Was this translation helpful? Give feedback.
-
|
Yep but MS has to make money for shareholders and I guess they want to coerce users into installing a data harvesting app? |
Beta Was this translation helpful? Give feedback.
-
I'm in the same situation, which is why I thought the warning was weird, then searched for it and ended up here. 🫤 I'm blocking the banner using this uBlock Origin query: |
Beta Was this translation helpful? Give feedback.
-
|
Oohh |
Beta Was this translation helpful? Give feedback.
-
|
Fido key |
Beta Was this translation helpful? Give feedback.
-
|
I love that it says "permanent account lockout" without any deadline and says "reduce your risk" as if MS is going to roll a dice to decide which dev is going to be locked out for no reason. |
Beta Was this translation helpful? Give feedback.
-
|
That's a nice github account you have there, would be a shame if something were to suddenly happen to it? |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
What is that supposed to mean why is it at risk? |
Beta Was this translation helpful? Give feedback.
-
|
A phone number can be registered in one's identity and then recovered if the SIM card is lost, so then you just need fireproof storage of passwords. |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
Hey @lcdunne , don't worry you'll not be permanently locked out, the warning is a bit misleading, let's say it's just an "advice" to use more than one |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for all your feedback folks and apologies for the confusion and inconvenience caused. As a quick update to our recently shipped security checkup experience, we have now rolled out a patch to restrict the new security check banners from being shown to users who already have a more secure 2FA method configured - Eg: Users who have configured an authenticator app. Which would mean that starting today, we would only prompt the users who have configured SMS as their only 2FA method to review and update their settings, since they need to have more than one 2FA method with a more secure option like an authenticator App. We hope that this change would help us influence more developers who contribute code on GitHub.com to enable one or more forms of secure two-factor authentication (2FA). |
Beta Was this translation helpful? Give feedback.
-
|
Makes a lot of sense, thanks for the update @N-Usha ! |
Beta Was this translation helpful? Give feedback.
Thanks for all your feedback folks and apologies for the confusion and inconvenience caused.
As a quick update to our recently shipped security checkup experience, we have now rolled out a patch to restrict the new security check banners from being shown to users who already have a more secure 2FA method configured - Eg: Users who have configured an authenticator app.
Which would mean that starting today, we would only prompt the users who have configured SMS as their only 2FA method to review and update their settings, since they need to have more than one 2FA method with a more secure option like an authenticator App.
We hope that this change would help us influence more developers who …