Hacker News Reader

Comment by mzs | Hacker News Reader

How do I actually do this? I want to keep using ssh. I don't have and don't want a cellphone. I use FreeBSD. I can't find a simple explanation in the docs.

View on HN

Use any password manager (you should already be using one) that has TOTP support such as keepassxc or 1Password. No cellphone needed.

I use a key-pair for github ssh. I don't use any password managers, instead I have unique long passwords. What's my second factor without a cellphone?

You can use OATHTOOL [1] on the command line or even roll your own TOTP implementation [2] in just a few lines of code in your favorite programming language.

[1] https://www.nongnu.org/oath-toolkit/oathtool.1.html [2] https://datatracker.ietf.org/doc/html/rfc6238

I don’t believe this 2FA announcement applies to SSH access. The public key you use is already 2FA enabled, in a sense (the key is what you have, the password to unlock it what you know).

This applies to logging in to the GitHub Web application.

Why should someone be using a password manager? Generating needlessly complex, unique passwords for each service seems like a good way to lock yourself out of your own accounts in an emergency.

Laptop or phone stolen? No access to your own devices? Oops guess you can't login to anything.

That is a scenario that is a lot less likely than some service having losing control over your password. If you are concerned about it, you can always write down the password into a physical notebook.

What about trying to login on someone elses device? Or your system crashing/corrupting?

The scenarios in which you are unable to use your password manager are far more likely than you're making it seem.

because it makes your passwords significantly less likely to be guessed

I don't know of a single competent service that allows you to just guess passwords more than a few times.

The biggest problem is re-using passwords. Remember when that LinkedIn password database with plaintext/md5 (easily brute-forced) was leaked a few years back? And who knows what's going on with Heroku right now. There's been dozens, hundreds, thousands of leaks like this, from well known sites like LinkedIn to that small independent webshop where you ordered something a few years ago. And for at least some people those credentials that worked on LinkedIn may also work on GitHub.

Having a unique password per service solves that particular issue. But you're right that there's a "price" in that losing access to your passwords would leave you screwed. I'd strongly recommend making sure you at least memorize your email password, as well as backing it up in several places.

Reply on news.ycombinator.com