2FA with Cell Phones is a bad idea<title>

[usafml2]

Select Topic Area

Product Feedback

Body

2FA with cell phones is a bad idea. Phones can be lost or stolen too easily. For people in difficult economic circumstances, they can loose cell phone service in a instant. This will hurt their ability to complete course work on LinkedIn Learning if they have to clone a repo. Even if they want to take the Git and Git hub course, lose of a cell phone could be devastating. 2FA could be accomplished with alternative email address in a much better way. Chuck.

[gil-son]

Hello, how are you?

When you created your 2FA, you received some sequence of words to recovery your access whether you lost your cellphone for example

If I supported you consider to mark my answer. Good Luck!

[CopperEagle]

I see where you are comming from @usafml2. However, you do not necessarily need a cellphone for 2FA at all. You can entirely do it all from a single device using an authenticator application. One such is KeePassXC which is open source and runs on all major OS and even as browser extension if I remember correctly. It gives you the code with the click of a button, no SMS or any of that.

[usafml2]

Thanks. I was able to get GiHub mobile on an Android device I can keep. The passkey idea. I think I am okay for now. I tested it and it seems to work. I am at a University library, and none of the machines I have IT control over. I could look into that with the IT people hear. They are pretty good at IUPUI. I have a windows 10 tablet. I will look into KeePassXC also. I haven't actually lost the phone yet, but it is in the works. Are alternative email addresses as 2FA out of the question? Chuck Watkins

…

On Wed, May 8, 2024 at 12:12 PM CopperEagle ***@***.***> wrote: I see where you are comming from @usafml2 <https://github.com/usafml2>. However, you do not necessarily need a cellphone for 2FA at all. You can entirely do it all from a single device using an authenticator application. One such is KeePassXC <https://keepassxc.org/> which is open source and runs on all major OS and even as browser extension if I remember correctly. It gives you the code with the click of a button, no SMS or any of that. — Reply to this email directly, view it on GitHub <#122959 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A5F57TPY4YEBRTB5EXW4FRDZBJFG7AVCNFSM6AAAAABHM6DAN6VHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TGNJXGA4DS> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[CopperEagle]

@usafml2 Nope, can't use email for 2FA. The options are Authenticator app, SMS, Security keys or Github Mobile. There are of course also the recovery keys but the mechanism isn't really designed for regular login at public computers.. They are needed to prepare against this 'lose phone lose account' scenario.

The email seems to be the last fallback when you loose access to 2FA AND recovery keys. Here is the whole process in full detail. The process can take several days.

If this answers your question, consider marking it as the answer.