Why am I being asked to add a second 2FA method?

[HCLarsen]

Select Topic Area

Question

Body

For the past few days, I've had a banner message appear on every github window saying:

Please configure another 2FA method to reduce your risk of permanent account lockout. If you use SMS for 2FA, we strongly recommend against SMS as it is prone to fraud and delivery may be unreliable depending on your region.

First of all, since I'm not using SMS, is this message telling me that I have to have multiple 2FA methods configured for my account, or is it a blanket message sent to all accounts, regardless of 2FA configuration?
Second of all, if Github recommends not using SMS, why is it even an option?

[TheGiraffe3]

Starting July 7th (3 days ago), 2FA is now required for all users, and you need to have multiple ways of verification.

[TheGiraffe3]

Not for all users, it may have been for an organization you were part of.

Multiple ways of auth are now required.

[HCLarsen]

No offence, but offering a guess to someone who wants a real answer is very unhelpful. If you don't know, you shouldn't respond.

[TheGiraffe3]

I was looking it up and going to edit it once I found the answer.

[HCLarsen]

It makes no sense to answer first, and then look up the answer. If you were trying to be helpful, you would have looked up an answer first. Instead, you're being rude by giving me 3 responses that don't answer my question.

[TheGiraffe3]

Not for all users, it may have been for an organization you were part of.

Is the gist.
Anyway, below corroborates with what I had said, it seems.

[davevad93]

Hi @HCLarsen ,

There has been a lot of debate in the last couple weeks on this topic, for instance here #129244. I'm not 100% sure but I think it's a general message to all GitHub users regardless of their 2FA configuration or plan (Free, Pro, Enterprise), in my opinion the warning is a bit misleading and here's why:

1. Actually it refers to having more than one 2FA method enabled, if you add one more the warning goes away.
2. The warning about permanent account lockout may mislead users into thinking that if they don't have a 2FA method enabled they may be locked out of their account by GitHub itself (I've seen various users concerned about that).
3. The SMS auth warning makes no sense at all, because if you add it as a second or third 2FA method, the warning goes away as well, I can confirm this because I've tested it myself.

So basically the warning is just a "tip" to encourage users to activate more than one 2FA method.

[HCLarsen]

@davevad93 thank you. This really clears it up.

[davevad93]

You're welcome @HCLarsen !

[davevad93]

@HCLarsen a few minutes ago, someone from the GitHub staff has given an official answer about this 2FA thing, I think you might be interested. Here is the link: https://github.com/orgs/community/discussions/129244#discussioncomment-10024978

[HCLarsen]

@davevad93 thank again. This update does actually make more sense.

[ven187]

I think that in the near future the password will no longer be used for systems and applications.