GitHub adds two-factor authentication option
Posted on 04 September 2013.
GitHub is the latest web-based service to add a 2-factor authentication feature to make the users' login process more secure.

"When logging in to GitHub, after providing your username and password, you will be asked for a two-factor authentication code that is delivered to your mobile device via SMS or a free two-factor application," Ben Toews, GitHub's resident application pentester explained simply. "This additional step ensures that a malicious person who has discovered your password will not be able to log in to GitHub as you."

The option can be turned on it the user's account settings, and works well with HTTPS Git, GitHub for Mac, GitHub for Windows, and the GitHub API.

For receiving the second authentication factor, users can either choose to receive it via a text message (not yet available for every country) or use a mobile app that supports the Time-based One-Time Password system, such as Google Authenticator, Duo Mobile or Authenticator.

When setting up the feature, users are also provided with a set of randomly generated recovery codes that they can save and use in case get locked out of their account, or they don't have their phone nearby. The option of adding a fallback cell phone number is also available, in case both the main phone and the recovery codes have been misplaced.


Credential manager system used by Cisco, IBM, F5 has been breached

Pearson VUE is part of Pearson, the world's largest learning company. Over 450 credential owners (including IT organizations such as IBM, Adobe, etc.) across the globe use the company's solutions to develop, manage, deliver and grow their testing programs.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Wed, Nov 25th