EEVblog Electronics Community Forum

Products => Computers => Programming => Topic started by: madires on March 10, 2023, 01:38:33 pm

Title: GitHub starts enforcing 2FA
Post by: madires on March 10, 2023, 01:38:33 pm
GitHub to require 2FA for all contributors starting from March 13: https://techcrunch.com/2023/03/09/github-to-require-2fa-for-all-contributors-starting-from-march-13-to-secure-the-software-supply-chain/

Nice and simple TOTP tool for linux: OTPClient
Title: Re: GitHub starts enforcing 2FA
Post by: Peabody on March 10, 2023, 05:30:03 pm
If someone doesn't have a smartphone or other mobile device, and is running Windows on his laptop, is there a way to set up 2FA at Github, or is he just SOL?
Title: Re: GitHub starts enforcing 2FA
Post by: madires on March 10, 2023, 05:34:47 pm
There are also plenty of TOTP tools for windows, e.g. 2fast (https://github.com/2fast-team/2fast).
Title: Re: GitHub starts enforcing 2FA
Post by: golden_labels on March 10, 2023, 06:27:18 pm
On March 13th GitHub starts rolling it out. The first wave of enforcement will not apply before July.

Title: Re: GitHub starts enforcing 2FA
Post by: JohanH on March 10, 2023, 07:05:31 pm
It's also convenient to use SSH protocol.
Title: Re: GitHub starts enforcing 2FA
Post by: SiliconWizard on March 10, 2023, 07:38:38 pm
It's also convenient to use SSH protocol.

Can SSH be used without 2FA?
Title: Re: GitHub starts enforcing 2FA
Post by: SiliconWizard on March 10, 2023, 07:43:05 pm
Currently, to push to a repo you need your username, and github token as a password.
How will 2FA work when using command-line tools?
Title: Re: GitHub starts enforcing 2FA
Post by: ejeffrey on March 10, 2023, 07:55:51 pm
To command line push to a repo with mandatory 2FA, I believe you currently need to use the git/ssh protocol instead of https and you need to authorize your ssh public key to your account which functions as the "second factor" although it's actually only one factor as it doesn't ask for your account password when you push.
Title: Re: GitHub starts enforcing 2FA
Post by: mwb1100 on March 10, 2023, 08:15:04 pm
Enabling 2FA on github affects pushing to/pulling from a repository only if you are using HTTPS as the git protocol.  If you're using SSH already it will be unaffected.

For pushing/pulling with HTTPS you will need to generate an HTTPS "token" to use as the password instead of using your web account's password.

See the following for details:

  - Using two-factor authentication with the command line (https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication#using-two-factor-authentication-with-the-command-line)
  - Creating a personal access token (https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)

The "Using two-factor authentication with the command line" page also talks about Git Credential Manager. As far as I know, that doesn't change what I said above - what is does is allow git to remember the HTTPS access token for a repository so after the first use you won't have to copy/paste it into an authentication dialog again.
Title: Re: GitHub starts enforcing 2FA
Post by: SiliconWizard on March 10, 2023, 08:27:12 pm
Enabling 2FA on github affects pushing to/pulling from a repository only if you are using HTTPS as the git protocol.  If you're using SSH already it will be unaffected.

For pushing/pulling with HTTPS you will need to generate an HTTPS "token" to use as the password instead of using your web account's password.

That's what I've already been doing, then. So, no change as far as I'm concerned.
I'm a bit failing to see how that is 2FA, though. The token just has a limited lifetime that you can adjust, but that's still just like a password. It's just one that github generates for you.

And you either need to type the token for every freaking command line (I c/c it, but that's still annoying), or store it in some configuration file in clear, which I don't do as it's horrific in terms of security.

Title: Re: GitHub starts enforcing 2FA
Post by: golden_labels on March 10, 2023, 09:16:00 pm
As far, as I understand, the change only applies to the cases using weak authentication. Not SSH, which is not vulnerable to service-side leaks, uses two factors by design, and provides resistance against phishing.

For most users this means: using the webapp. This is the primary reason to have an account on GitHub, but the change seems to not be preventing e.g. pushes by designated collaborators.
Title: Re: GitHub starts enforcing 2FA
Post by: mwb1100 on March 10, 2023, 09:36:11 pm
"Classic" github tokens are about 36 random characters long.
Newer "fine-grained" tokens are about 80 random characters long.

These are *much* stronger than your typical web account password.

Also I was wrong about what I said for Git Credential Manager. The basic "git credential store" stores passwords in a plaintext file (I'd still argue that a plaintext file on a local machine with a long random password is generally still more secure than using a web account password in most cases).  However the "Git Credential Manager" (sometimes referred to as "Git Credential Manager Core") is a separate project that adds credential management using a system's secure storage (ie., the Windows Credential Manager on Windows) as well as supports actual 2FA authentication.

From the GCM readme (https://github.com/git-ecosystem/git-credential-manager/blob/main/README.md#download-and-install):

Quote
when pushing (git push) to Azure DevOps, Bitbucket, or GitHub, a window will automatically open and walk you through the sign-in process. (This process will look slightly different for each Git host, and even in some cases, whether you've connected to an on-premises or cloud-hosted Git host.) Later Git commands in the same repository will re-use existing credentials or tokens that GCM has stored for as long as they're valid

If locally stored plaintext passwords are a concern you should look into Git Credential Manager.

  - Git Credential Manager: authentication for everyone (https://github.blog/2022-04-07-git-credential-manager-authentication-for-everyone/)

Another thing I forgot: Git for Windows includes GCM now, so you might be using it already if you're on Windows.
Title: Re: GitHub starts enforcing 2FA
Post by: alm on March 10, 2023, 10:38:35 pm
If someone doesn't have a smartphone or other mobile device, and is running Windows on his laptop, is there a way to set up 2FA at Github, or is he just SOL?
Many password managers that you might use, like Keepass, or 1Password, can also function as TOTP generator. Of course you should evaluate the security implications of this. It's definitely a step down from having the secret stored on a separate device (mobile phone).

"Classic" github tokens are about 36 random characters long.
Newer "fine-grained" tokens are about 80 random characters long.

These are *much* stronger than your typical web account password.
And SSH private keys are much longer than that. And is an asymmetric system, so the private key is never transmitted. Plus SSH keys have the ability to protect them with a passphrase (two factor) and optionally remembering this passphrase for the duration of the session built in. I don't understand jumping through so many hoops just to be able to use HTTPS, unless you are behind a very restrictive firewall. But Github allows SSH over port 443, so even that's not a very convincing argument. What advantage do you see of using HTTPS instead of SSH for authenticated access?

However the "Git Credential Manager" (sometimes referred to as "Git Credential Manager Core") is a separate project that adds credential management using a system's secure storage (ie., the Windows Credential Manager on Windows) as well as supports actual 2FA authentication.
Until you run into an URL of more than 256 characters (happens with some automatically-generated URLs), then the Windows Credential Manager is useless and you have to fall back to plain text store. I haven't seen this issue on Linux or Mac, fortunately.
Title: Re: GitHub starts enforcing 2FA
Post by: golden_labels on March 11, 2023, 05:47:29 am
And SSH private keys are much longer than that. And is an asymmetric system, so the private key is never transmitted. Plus SSH keys have the ability to protect them with a passphrase (two factor) and optionally remembering this passphrase for the duration of the session built in.
Just to be clear, what are the numbers: typical SSH keys are 240–512 bits, a 80-character token is 376–480 bits. So the entropy is in both cases in a similar range.

I don't understand jumping through so many hoops just to be able to use HTTPS, unless you are behind a very restrictive firewall. But Github allows SSH over port 443, so even that's not a very convincing argument. What advantage do you see of using HTTPS instead of SSH for authenticated access?
The primary reason to even use GitHub are features outside of the Git itself. These are available only through their webapp or, at most, HTTPS-only API. SSH is also a solution inaccessible to most of GitHub audience.
Title: Re: GitHub starts enforcing 2FA
Post by: mwb1100 on March 11, 2023, 08:31:50 am

"Classic" github tokens are about 36 random characters long.
Newer "fine-grained" tokens are about 80 random characters long.

These are *much* stronger than your typical web account password.
And SSH private keys are much longer than that. And is an asymmetric system, so the private key is never transmitted. Plus SSH keys have the ability to protect them with a passphrase (two factor) and optionally remembering this passphrase for the duration of the session built in. I don't understand jumping through so many hoops just to be able to use HTTPS, unless you are behind a very restrictive firewall. But Github allows SSH over port 443, so even that's not a very convincing argument. What advantage do you see of using HTTPS instead of SSH for authenticated access?

I do generally use SSH and understand that it is better then HTTPS tokens in most ways.  I'm just explaining reasons why the HTTPS tokens are more secure than using the web account credentials.  Clearly a lot of people use HTTPS access or github, gitlab and other git hosting outfits wouldn't jump through hoops to support it.  People who use Windows are generally unfamiliar with SSH, and as an example several people I work with use HTTPS for github and gitlab access.  I might suggest or encourage using SSH, but I'm not going to force anyone else to use SSH.

However the "Git Credential Manager" (sometimes referred to as "Git Credential Manager Core") is a separate project that adds credential management using a system's secure storage (ie., the Windows Credential Manager on Windows) as well as supports actual 2FA authentication.
Until you run into an URL of more than 256 characters (happens with some automatically-generated URLs), then the Windows Credential Manager is useless and you have to fall back to plain text store. I haven't seen this issue on Linux or Mac, fortunately.

I wasn't aware of that limitation.  Do you have a pointer to more information about this behavior?  I can' t find any issue or discussion topic about it at the https://github.com/git-ecosystem/git-credential-manager site.
Title: Re: GitHub starts enforcing 2FA
Post by: madires on March 11, 2023, 11:22:55 am
I'm also using ssh for accessing repos and created a dedicated key set for GitHub. In openssh it's easy to tie a key to a specific domain (.ssh/config):
Code: [Select]
# dedicated key for GitHub
Host github.com
  User git
  IdentityFile ~/.ssh/myGitHubKey
  IdentitiesOnly yes
  UpdateHostKeys yes

IIRC, you can alternatively change the git settings of the local repo copy to use a specific ssh key. It's just less convenient.
Title: Re: GitHub starts enforcing 2FA
Post by: Peabody on March 11, 2023, 02:39:18 pm
I have 10 Github repos, but have never installed git or any github web app.  I just use my browser in Windows to create and modify the repos on the site.  Can someone clarify if the 2FA requirement will apply to me, and if so how I can satisfy it.  I don't use a mobile device.  2fast was mentioned earlier, but Github's explanation of 2FA says a phone is required.

 > For GitHub, the second form of authentication is a code
 > that's generated by an application on your mobile device or
 > sent as a text message (SMS). After you enable 2FA, GitHub
 > generates an authentication code any time someone attempts
 > to sign into your account on GitHub.com. The only way
 > someone can sign into your account is if they know both
 > your password and have access to the authentication code on
 > your phone.

Title: Re: GitHub starts enforcing 2FA
Post by: shapirus on March 11, 2023, 02:42:36 pm
SSH is also a solution inaccessible to most of GitHub audience.
This is an interesting statement.

I thought GitHub was used mostly by programmers. Was I wrong?
Title: Re: GitHub starts enforcing 2FA
Post by: madires on March 11, 2023, 03:49:33 pm
I don't use a mobile device.  2fast was mentioned earlier, but Github's explanation of 2FA says a phone is required.

It's explained here: https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication

Your second factor can be:
- TOTP (app on mobile device, PC or whatever)
- SMS

And after setting up 2FA with TOTP or SMS you can add additionally:
- security key
- GitHub Mobile app
Title: Re: GitHub starts enforcing 2FA
Post by: Peabody on March 11, 2023, 04:04:16 pm
Maybe it's just shorthand, and not literally true, but they talk only about a "TOTP mobile app".
Title: Re: GitHub starts enforcing 2FA
Post by: shapirus on March 11, 2023, 04:12:14 pm
Maybe it's just shorthand, and not literally true, but they talk only about a "TOTP mobile app".
TOTP is just an algorithm. Any computer can be programmed to run it.
Title: Re: GitHub starts enforcing 2FA
Post by: Karel on March 11, 2023, 04:50:26 pm
GitHub to require 2FA for all contributors starting from March 13: https://techcrunch.com/2023/03/09/github-to-require-2fa-for-all-contributors-starting-from-march-13-to-secure-the-software-supply-chain/

Nice and simple TOTP tool for linux: OTPClient

Thanks but I moved everything from github to Gitlab.
I stay away from tech giants because they are arrogant and do whatever they like.
The last thing I'll do is giving them my telephone number.
Title: Re: GitHub starts enforcing 2FA
Post by: jonovid on March 11, 2023, 05:13:41 pm
look for other open source software development project sites Not owned by  tech giant MS
Title: Re: GitHub starts enforcing 2FA
Post by: madires on March 11, 2023, 05:18:53 pm
Maybe it's just shorthand, and not literally true, but they talk only about a "TOTP mobile app".

Apparently they assume that the second factor should be on a different device. However, as shapirus mentioned, TOTP is a standard described in RFC6238. You can even run that on an Arduino (https://github.com/lucadentella/TOTP-Arduino).
Title: Re: GitHub starts enforcing 2FA
Post by: Peabody on March 11, 2023, 05:25:23 pm
For Arduino?  Now I'm interested.
Title: Re: GitHub starts enforcing 2FA
Post by: golden_labels on March 11, 2023, 05:28:42 pm
I have 10 Github repos, but have never installed git or any github web app.  I just use my browser in Windows to create and modify the repos on the site.
Would it be a problem, if I asked: what is the motivation behind using GitHub in that instance?

Can someone clarify if the 2FA requirement will apply to me, and if so how I can satisfy it.
Yes, it will.

I don't use a mobile device.  2fast was mentioned earlier, but Github's explanation of 2FA says a phone is required.
Phone will not be required and, while remain an available option, GitHub discourages this option:
Quote
We strongly recommend the use of security keys and TOTPs wherever possible. SMS-based 2FA does not provide the same level of protection, and it is no longer recommended under NIST 800-63B.

I thought GitHub was used mostly by programmers. Was I wrong?
Yes, it is used mostly by programmers. You are not wrong in that. But you may be wrong in making additional assumptions about what “being programmer” implies.

Thanks but I moved everything from github to Gitlab.
I stay away from tech giants because they are arrogant and do whatever they like.
Are you sure, you ran away? Or were misled into believing GitLab is some small, nice company? It s an NASDAQ-traded international corporation at the same scale as GitHub.

The last thing I'll do is giving them my telephone number.
You somehow missed, that GitHub explicitly asks to not use mobile phone for that purpose.
Title: Re: GitHub starts enforcing 2FA
Post by: Peabody on March 11, 2023, 05:41:17 pm
I have 10 Github repos, but have never installed git or any github web app.  I just use my browser in Windows to create and modify the repos on the site.
Would it be a problem, if I asked: what is the motivation behind using GitHub in that instance?

Not a problem at all.  I use it to post software I've written, and some circuits I've developed, that might be useful to others, and that I can link to from forums like this.  I don't have any other place to post it.  From looking around there, it appears a lot of other people use Github for the same purpose.
Title: Re: GitHub starts enforcing 2FA
Post by: shapirus on March 11, 2023, 05:42:50 pm
Yes, it is used mostly by programmers. You are not wrong in that. But you may be wrong in making additional assumptions about what “being programmer” implies.
Well, may or may not. I guess I won't be very wrong if I say that git (as well as many other protocols) over ssh is the industry-standard approach. SSH is a well-established and very convenient way of tunnelling IP protocols over an encrypted TCP connection.
Title: Re: GitHub starts enforcing 2FA
Post by: golden_labels on March 11, 2023, 06:38:06 pm
It is common in major companies in European and North American countries, and possibly some dependent companies elsewhere. That is hardly a representative sample of people engaging in programming. And even in this case workers rarely set SSH up themselves.
Title: Re: GitHub starts enforcing 2FA
Post by: shapirus on March 11, 2023, 06:58:58 pm
And even in this case workers rarely set SSH up themselves.
I would fire the developer who can't set up an SSH client without any hesitation. This is one of the very basic skills of the profession.

(and I haven't ever met any who couldn't.)
Title: Re: GitHub starts enforcing 2FA
Post by: mwb1100 on March 11, 2023, 09:23:15 pm
Many password managers support 2FA protocols.  The one I use (SafeInCloud) is free - but not open source - for the Windows desktop.

You don't need to use a phone if you don't want to.
Title: Re: GitHub starts enforcing 2FA
Post by: mwb1100 on March 11, 2023, 10:02:00 pm
And even in this case workers rarely set SSH up themselves.
I would fire the developer who can't set up an SSH client without any hesitation. This is one of the very basic skills of the profession.

(and I haven't ever met any who couldn't.)

SSH is not particularly common on Windows, and the SSH tools that come with Windows (even Win11) are old and broken, so you will likely have to find an alternative set of tools and get them installed and configured.

And as I noted before, clearly there is a large set of github users who don't use SSH, otherwise github (and others) would likely not put in the effort to support pushing & pulling using HTTPS with special tokens or 2FA.

I guess I won't be very wrong if I say that git (as well as many other protocols) over ssh is the industry-standard approach. SSH is a well-established and very convenient way of tunnelling IP protocols over an encrypted TCP connection.

Do you realize that when you click on the button to get a repository URL from github that the default is HTTPS?  I'd guess that the vast majority of people pushing to github (and without a doubt pulling from github) are using HTTPS - especially people using Windows.
Title: Re: GitHub starts enforcing 2FA
Post by: shapirus on March 11, 2023, 10:27:15 pm
SSH is not particularly common on Windows
a software developer who uses windows is, at least, suspicious, because it's the OS which is specifically designed to kill the programmer's productivity.
Title: Re: GitHub starts enforcing 2FA
Post by: mwb1100 on March 12, 2023, 02:36:50 am
Seems a few people disagree.  From https://www.thurrott.com/dev/277533/report-more-developers-use-linux-than-a-mac: (https://www.thurrott.com/dev/277533/report-more-developers-use-linux-than-a-mac:)

Quote
As for the platforms that developers use, Windows retains its lead, with 62.33 percent of respondents using Windows for personal use and 48.82 percent using it for work. Linux is number two, with 40 and 40 percent, respectively, while the Mac brings up the rear with 31 and 33 percent.

Regardless of your opinions of people who use Windows or don't use SSH, there's a lot of them.  Hence github's HTTPS tokens.

And one nice thing about that is that it doesn't prevent you in any way from using SSH. And there's a large pool of people for you to evangelize SSH (or put down).
Title: Re: GitHub starts enforcing 2FA
Post by: PlainName on March 12, 2023, 04:59:10 pm
SSH is not particularly common on Windows
a software developer who uses windows is, at least, suspicious, because it's the OS which is specifically designed to kill the programmer's productivity.

In what way, and how does the OS do that?

And is that worse than developing code on the product you're making? Some developers insist on having their RPi or similar compile the code, for instance.
Title: Re: GitHub starts enforcing 2FA
Post by: alm on March 13, 2023, 06:30:48 pm
I wasn't aware of that limitation.  Do you have a pointer to more information about this behavior?  I can' t find any issue or discussion topic about it at the https://github.com/git-ecosystem/git-credential-manager site.
It's not a limitation in git credential manager, it's a limitation in Windows Credential Store. We had it with another tool that was using the Windows Credential Store. Looking at https://learn.microsoft.com/en-us/windows/win32/api/wincred/ns-wincred-credentiala (https://learn.microsoft.com/en-us/windows/win32/api/wincred/ns-wincred-credentiala), I'm not 100% sure into what limit we ran. Maybe the one for the credentials blob? Either way, the end result was that we had to fall back to plain text files for secret storage on Windows system (a downgrade in security), while things worked smooth on Mac and Linux systems with their native secret stores.
Title: Re: GitHub starts enforcing 2FA
Post by: c64 on March 14, 2023, 12:06:28 am
SSH is not particularly common on Windows
a software developer who uses windows is, at least, suspicious, because it's the OS which is specifically designed to kill the programmer's productivity.
It depends which version of windows. My main dev workstation is Win7 (couple of years ago it was XP  8) ) and Debian is secondary. I find Win7 more convenient.