“At GitHub, we believe our unique position as the home for all developers gives us the opportunity and responsibility to raise the bar for security across the software development ecosystem,” Mike Hanley, GitHub’s chief security officer, wrote in his blog.
“Although we are investing significantly in our platform and the broader industry to improve the overall security of the software supply chain, the value of these investments is fundamentally limited if we don’t address the persistent risk of account compromise.”
GitHub committed to investing in protections for npm accounts after account compromises where 2FA was not enabled led to package takeovers.
Today, fewer than 20% of GitHub users and 6,44% of npm users use the recommended forms of two-factor authentication.
Previous efforts by GitHub to protect developers include finding and revoking known compromised user passwords, offering robust support for WebAuthn security keys, and enrolling all npm publishers in enhanced login verification.
As a result of the policy change, GitHub will require all developer accounts to enable one or more forms of 2FA by the end of 2023.
We asked GitHub to comment on why it had decided on such a lengthy transition period, and here’s the response:
“While we’re excited to improve 2FA adoption, we also understand that security you can’t use isn’t meaningful security. Taking the time to provide developers with a simple and accessible experience will help us ensure a successful rollout, and will also help normalize two-factor authentication as something that shouldn’t be seen as a nuisance.
We believe that the time and investment will allow us to make the experience even more pleasant as we work toward our goal of improving adoption. We’ve also made great strides in rolling out two-factor authentication for npm in stages. This has allowed us to make sure we’re moving in the right direction, gather customer feedback, and adapt our approach as needed.”
While it’s good to see GitHub acknowledge the risks of compromised accounts, many will still question the need for such a lengthy delay in implementing the policy, given the heightened risks today.
A growing number of services already require 2FA, and we’re confident that GitHub and its users can do the same by the end of this year to prevent further attacks using compromised accounts.
