Hacker News Reader

Comment by koolba | Hacker News Reader

> Today, only approximately 16.5% of active GitHub users and 6.44% of npm users use one or more forms of 2FA.

That's atrociously low. I know it's caveat emptor when it comes to FOSS, particularly as the nominal price is usually $0, but that really needs to be bumped up for anyone that is publishing packages to a public registry.

I hope they both mandate it for NPM and publicly flog^Wflag any existing accounts as "2FA Not Enabled" so that users can use that information to make their own choices about which dependencies to include in their projects.

View on HN

It's actually higher than I expected. I've mandated a lot of different contractors use MFA over the years and the fighting back has been depressing.

> flag any existing accounts as "2FA Not Enabled" so that users can use that information to make their own choices about which dependencies to include in their projects.

Fine, do that. I don't care. Just don't force me to use 2FA if I don't want to. I prefer the convenience over the extra security. This change removes that choice from everyone.

Have you tried using something like a YubiKey? You literally just tap it and you're authenticated. No pulling out your phone and typing anything.

I don't want to use 2FA, and I certainly don't want to have to buy something to use 2FA. What is hard to understand about that?

It sounded like you didn't like the hassle of using TOTP from a phone which is most people's complaint when using 2FA. I was offering a basically zero friction, more user friendly alternative which provides both convenience and security.

But then I need to buy a YubiKey (€45), and set it up on my Linux machines which seems to require some PAM stuff, and lose one of the two USB ports on my laptop, and carry it around, and make a plan for when I lose it or when it breaks.

And the advantage is ... I don't know? If you have a strong random non-reused password I'm not seeing any. The only hypothetical advantage is when someone compromises your email account or desktop, but support departments tend to just reset 2FA if asked, so it's not actually a protection.

No need for "PAM stuff" on Linux, plug it in and it's ready to use as a 2FA webauthn device. I think you can use it for PAM but I've never tried.

You can set it up as a GPG smart card if you're that way inclined (which also means you can use it as an SSH private key as well). The advantage there is that your private keys are never on your machine which means they stay secure even if your machine is compromised which is nice.

As for MFA (YubiKey or otherwise), I believe the "hassle" is worth the inconvenience. It means that of my (single site, very complex) passwords are compromised in any way my accounts will remain secure long enough for me to change passwords.

Mercy me, that's some mighty smart incentive centered design you done schemed up.

Reply on news.ycombinator.com