GitHub is trying to make it easier for users to implement two-factor authentication (2FA). To that end, the organization is launching a new GitHub Mobile 2FA utility that will secure the login process for people using Android and iOS devices.
GitHub Mobile 2FA will be available through Apple’s App Store and the Google Play Store, and is designed to provide users with an in-house alternative to existing 2FA methods. The GitHub platform already offers support for third-party SMS one-time passcode applications, and for security keys and biometric authentication through the WebAuthn protocol.
The new app, on the other hand, is fully integrated into the GitHub service. Once it has been set up, users will receive a push notification on their mobile device when they try to access their GitHub accounts through a browser. They can then use the app to approve that login attempt, at which point they will automatically be granted access to GitHub in the browser. They can also reject the attempt to bar access if the account holder does not recognize the login.
Anyone who has not yet activated 2FA will need to use some kind of one-time password to get things set up the first time they use the mobile verification service. Those who are already using 2FA simply need to update the mobile app to begin taking advantage of the new feature. However, GitHub stressed that security keys are the strongest 2FA technology currently supported through the platform, and that it will continue treat a security key as the primary second authentication factor for anyone who is using one.
The new app is in keeping with GitHub’s history of encouraging people to use stronger authentication factors. As of August, the organization no longer allows people to authenticate Git operations with a password alone, and in May it partnered with Yubico to enable the use of FIDO U2F and FIDO2 security keys. For its part, the FIDO Alliance has repeatedly argued that multi-factor authentication is necessary to maintain a strong security environment.