GitHub adds two-factor authentication option

GitHub is the latest web-based service to add a 2-factor authentication feature to make the users’ login process more secure.

“When logging in to GitHub, after providing your username and password, you will be asked for a two-factor authentication code that is delivered to your mobile device via SMS or a free two-factor application,” Ben Toews, GitHub’s resident application pentester explained simply. “This additional step ensures that a malicious person who has discovered your password will not be able to log in to GitHub as you.”

The option can be turned on it the user’s account settings, and works well with HTTPS Git, GitHub for Mac, GitHub for Windows, and the GitHub API.

For receiving the second authentication factor, users can either choose to receive it via a text message (not yet available for every country) or use a mobile app that supports the Time-based One-Time Password system, such as Google Authenticator, Duo Mobile or Authenticator.

When setting up the feature, users are also provided with a set of randomly generated recovery codes that they can save and use in case get locked out of their account, or they don’t have their phone nearby. The option of adding a fallback cell phone number is also available, in case both the main phone and the recovery codes have been misplaced.