GitHub upgrades two-factor authentication with WebAuthn support

Standard enables more security key options with passwordless a future possibility

GitHub is taking further steps to encourage users not to rely on passwords

GitHub has announced support for the Web Authentication (WebAuthn) security standard.

GitHub already supports two-factor authentication (2FA) via SMS texts (the least secure option, given that phone numbers can be hijacked and SMS messages intercepted), one-time password authentication apps, or U2F (Universal Second Factor) security keys.

U2F is an older standard, though, and in March this year the World Wide Web Consortium (W3C) approved the WebAuthn specification, part of the FIDO Alliance’s FIDO2 specification set.

The move to WebAuthn means GitHub supports physical security keys via browsers including Firefox and Chrome on Windows, macOS, Linux and Android, on macOS with preview versions of Safari, and on iOS with Brave and a YubiKey 5Ci.

Securing a GitHub account with a physical security key

You also now have an option to opt for a laptop or phone as a security key, using Windows Hello, Touch ID on macOS, or a fingerprint reader on Android.

GitHub currently only supports security keys as a supplementary option, available once you have already set up 2FA using SMS or an authenticator app. That said, GitHub is exploring making security keys a primary option, or even to enable passwordless login.

A potential hazard with 2FA is the risk of getting locked out of your account. GitHub offers a couple of ways around this, including recovery codes that appear when you set up 2FA, that you can print out or copy to a password manager, and a suggestion that you use an authenticator app that permits backup of your keys, unlike Google Authenticator or Microsoft Authenticator.

Securing GitHub accounts is a priority since compromise may enable a bad guy to insert backdoors, password stealers, or other malware into the code for an application, a website, or library code used by multiple developers. Malware was recently discovered in a Ruby Gem package, believed to be caused by a hacked developer account. ®