On March 13, we will officially begin rolling out our initiative to require all developers who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023. Read on to learn about what the process entails and how you can help secure the software supply chain with 2FA.
Okay, so generally the way it works is you have some app (e.g. Google Authenticator, 1password, Aegis, Bit warden – anything that supports TOTP). When you enable 2FA for a site, it’ll give you a QR code. You scan that with your app and then the app gives you a six digit code that changes every 30 seconds.
The QR code is really just an easy way to get a long string of characters into your app, though, and if the QR code doesn’t work there should be an option to see the raw code and manually enter it.
You enter that code in once to confirm that you have actually set up the 2FA. Then it will show you a list of recovery codes. It’ll only show you these once; it doesn’t store them anywhere. You need to note them down in whatever way suits you best (I print mine; you could also just write them down). You cannot see these again. The best you can do, if you still have access to your account, is generate new ones (probably by disabling and re-enabling 2FA)
Now, whenever you login, you’ll be asked for your authenticator code (much like an SMS). You just open whatever app you used and enter in whatever code it’s currently showing (remember it’s time based).
If your authenticator app gets messed up somehow, you can recover it using your recovery codes.
How do I feed the generated QR code back to GitHub, then? Can I upload an image of it?
Have you ever used any website with 2FA? You don’t need to upload QR codes.
I’ve only used SMS and Steam 2FA so far. I’ve been avoiding 2FA as much as I can.
Okay, so generally the way it works is you have some app (e.g. Google Authenticator, 1password, Aegis, Bit warden – anything that supports TOTP). When you enable 2FA for a site, it’ll give you a QR code. You scan that with your app and then the app gives you a six digit code that changes every 30 seconds.
The QR code is really just an easy way to get a long string of characters into your app, though, and if the QR code doesn’t work there should be an option to see the raw code and manually enter it.
You enter that code in once to confirm that you have actually set up the 2FA. Then it will show you a list of recovery codes. It’ll only show you these once; it doesn’t store them anywhere. You need to note them down in whatever way suits you best (I print mine; you could also just write them down). You cannot see these again. The best you can do, if you still have access to your account, is generate new ones (probably by disabling and re-enabling 2FA)
Now, whenever you login, you’ll be asked for your authenticator code (much like an SMS). You just open whatever app you used and enter in whatever code it’s currently showing (remember it’s time based).
If your authenticator app gets messed up somehow, you can recover it using your recovery codes.