I was wondering when Github was going to start supporting HSTS and 2-Factor Auth. I'm betting that it gets bumped in priority after this event. Nothing like an incident to move along security requirements!
2FA serves as an annoyance to phishers, but whoever is doing this network attack has direct access to your session cookie.