require 2FA to be on Gratipay GitHub org

[chadwhitacre]

Kenneth got hacked, illustrating the importance of 2FA. We should require 2FA on GitHub for anyone with permission to deploy, and maybe for everyone on the GitHub org.

[ghost]

Do you already have the percentage of 2FA activation for the Gratipay team? Requiring it for everybody would imply that everybody has long-term working phone number or the Google
Authenticator application. However, 2FA using SMS is being deprecated by the NIST so we can expect big companies (Github?) to follow the new recommendations.

I think that forcing it for users with access to private repositories and deploy permission is a good thing, and then strongly suggest (≠ force) to everybody in the organisation to follow the movement.

Github has a great article about how to use all the services after enabling the 2FA (spoil: you may need to generate personal tokens to clone via https).

[chadwhitacre]

I don't have a smart phone, and I'm curious to see how long I can hold out with SMS 2FA being phased out.

All three of us on the "Deployers" team (@clone1018 @rohitpaulk @whit537) have 2FA enabled. We are at 33% overall (8 / 24).

I guess we're saying that's okay for now?

[ghost]

Yep, I think.

[chadwhitacre]

What about Heroku? And DNSimple? And MaxCDN? And Digital Ocean? Seems like we should adopt a 2FA policy for any system involved in production.

[ghost]

(and HackerOne)

[EdOverflow]

I currently use the Google Authenticator app, since I do not like to use SMS 2FA. I also plan on getting a YubiKey. @whit537 Maybe you might want to look into a YubiKey for important accounts?

---

Here is a list of pages regarding 2FA on services we use:

• Heroku
• DNSimple
• MaxCDN