Two-factor authentication (2FA) is an extra layer of security used when logging into websites or apps. With 2FA, users have to log in with their username and password and provide a second form of authentication, such as a code generated by an application on their mobile device or a text message. This additional step makes it more difficult for unauthorized users to access accounts, as they would need both the user’s password and the second form of authentication. GitHub is requiring all users who contribute code on GitHub.com to enable 2FA to improve security for individual developers and the broader software development ecosystem. This is part of GitHub’s efforts to protect against credential theft or leakage, which are common causes of security breaches. Enabling 2FA is important for GitHub users as it significantly enhances the security of their accounts, not only on GitHub but also on other websites and apps that support 2FA. It is strongly recommended to enable 2FA to safeguard accounts from unauthorized access and potential security breaches.
Starting in March 2023 and through the end of 2023, GitHub will gradually begin to require all users who contribute code on GitHub.com to enable one or two-factor authentication (2FA). This is part of GitHub’s efforts to improve security for both individual developers and the broader software development ecosystem. If you are in an eligible group, you will receive a notification email when that group is selected for enrollment, marking the beginning of a 45-day 2FA enrollment period, and you will see banners asking you to enroll in 2FA on GitHub.com. If you don’t receive a notification, then you are not part of a group required to enable 2FA, but it is still strongly recommended.
Two-factor authentication (2FA) is an additional layer of security that helps protect your account from unauthorized access. It requires you to provide a code generated by an application on your mobile device or a text message when signing in to your account. This adds an extra step to the login process, making it more difficult for attackers to gain access to your account.
There are several methods to configure 2FA on GitHub:
- TOTP app on mobile or desktop: You can use a time-based one-time password (TOTP) app on your mobile device or desktop to generate the authentication code.
- Text message: You can receive a text message containing the authentication code.
- Recovery codes: When you configure 2FA, you’ll download and save your 2FA recovery codes. If you lose access to your phone, you can use these codes to regain access to your account.
If you lose your 2FA credentials, GitHub Support will not be able to restore access to accounts with two-factor authentication enabled. It is essential to remember your password and have access to your recovery methods to avoid account lockouts.
For users who are part of an organization that requires 2FA, you cannot disable 2FA without first leaving the organization. If you are a member, billing manager, or outside collaborator to a public repository of an organization that requires two-factor authentication and you want to disable 2FA, you will be automatically removed from the organization, and you will lose your access to their repositories. To regain access, you will need to re-enable two-factor authentication and contact an organization owner.
In summary, GitHub is gradually requiring users to enable 2FA for increased security. There are several methods to configure 2FA, including using a TOTP app, text message, or recovery codes. If you lose your 2FA credentials, you will need to use the recovery codes or request a reset. Disabling 2FA without leaving the organization that requires it is not allowed.
If GitHub users do not enable two-factor authentication (2FA) before the deadline, their access to GitHub will be limited. Starting on January 19th, 2024 at 00:00 (UTC), users who have not set up 2FA will be required to do so for authentication[1]. If users fail to enable mandatory 2FA within the 45-day setup period and allow the 7-day grace period to expire, they will not be able to access GitHub.com until they enable 2FA. If users attempt to access GitHub.com without enabling 2FA, they will be prompted to do so. If users fail to enable mandatory 2FA, tokens that belong to their account will continue to function since they are used in critical situations. However, GitHub strongly recommends enabling 2FA for the safety of users’ accounts, not only on GitHub but also on other websites and apps that support 2FA.
GitHub supports various authentication methods for two-factor authentication (2FA). These methods help provide an extra layer of security when logging into GitHub.com. The available authentication methods include:
- TOTP apps on mobile or desktop: Time-based one-time password (TOTP) apps generate a new authentication code every 30 seconds. Users can use these apps to provide the required code when logging into their GitHub account.
- Text messages: GitHub supports sending authentication codes via text messages to users’ mobile devices.
- Recovery codes: During the 2FA setup process, users can save recovery codes that can be used to regain access to their account if they lose their 2FA credentials.
- GitHub Mobile: Starting in March 2023, GitHub Mobile will support 2FA. Users can configure 2FA using a TOTP app or text message and then use GitHub Mobile to authenticate.
- Passkeys: Passkeys allow users to sign in securely to GitHub.com without having to input their password. If users have 2FA enabled, passkeys satisfy both password and 2FA requirements.
These authentication methods help protect users’ accounts from unauthorized access and potential security breaches. GitHub strongly recommends enabling 2FA for the safety of users’ accounts, not only on GitHub but also on other websites and apps that support 2FA.
To enable two-factor authentication (2FA) on your GitHub account, follow these steps:
- Log in to GitHub.com: Click your profile photo in the upper-right corner of any page and click “Settings”.
- Navigate to the 2FA settings: In the “Access” section of the sidebar, click “Password and authentication”.
- Enable 2FA: In the “Two-factor authentication” section of the page, click “Enable two-factor authentication”.
- Choose a 2FA method: GitHub supports various 2FA methods, such as TOTP apps on your mobile device or desktop, text messages, and recovery codes. Select the method that best suits your needs.
- Configure the 2FA method: Depending on the chosen method, you will need to scan a QR code with your mobile device or enter a code sent to your phone. Follow the on-screen instructions to complete the setup process.
- Save recovery codes: During the 2FA setup process, you will be prompted to save recovery codes. These codes will help you regain access to your account if you lose your 2FA credentials. It is essential to save these codes securely.
Once you have completed these steps, your account will be secured with 2FA, providing an additional layer of security to protect against unauthorized access. Remember that starting in March 2023 and through the end of 2023, GitHub will gradually begin to require all users who contribute code on GitHub.com to enable one or two-factor authentication. If you are part of an eligible group, you will receive a notification email when that group is selected for enrollment, marking the beginning of a 45-day 2FA enrollment period.
Sources:
https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa
https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization
https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication
https://github.com/orgs/community/discussions/68240
https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/about-mandatory-two-factor-authentication
https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/about-two-factor-authentication
https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account
https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials
https://www.bleepingcomputer.com/news/software/github-warns-users-to-enable-2fa-before-upcoming-deadline/
https://github.com/orgs/community/discussions/63738