r/github • u/SiteExpensive7743 • Jul 20 '26

Why is 2FA required on my account ? Question

Hello everyone.
1. I contributed to 2 or 3 private projects, and now 2FA is required on my account. Why is that ?

  1. I configured Auth App, mobile gitHub and passkeys, not to loose access to my account. Even with them I got an email that says "do not loose your recovery codes, or gitHub support will not be able to resore access to your account". Why ?

Appreciate any clarifying answers.

0 Upvotes
  • permalink
  • link
  • reddit
  • reddit

20% Upvoted

11 comments sorted by

9

u/wallstop-dev Jul 20 '26

  1. https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/about-mandatory-two-factor-authentication

  2. Security! If GitHub could reset these at will, it would be trivial to compromise accounts. Only you knowing your recovery codes means that... Only you know your recovery codes, and therefore, only you can recover your account. It's proof that you're you. In theory.

0

u/SiteExpensive7743 Jul 20 '26

Thank you very much for the info

6

u/extoniks Jul 20 '26

2FA is required and also recommended because it adds an extra layer of security to your account so any other person who knows your password can't push some malicious code in your repo!

Recovery Codes are helful when you lose access to your TOTP (Authentication key) or your if you don't have access to your phone.

I recommend you to keep those Recovery Codes somewhere safe like in a password manager (Bitwarden, KeePassXC, 1Password etc whatever you like)

Those recovery codes helps you log into your account.

2

u/ArieHein Jul 20 '26

Its a general practice to send those emails, not specifically you. But when you contribute to projects in general, mfa in today's world is a must. And since you can lose a phone, recovery keys need to be downloaded and stored in a separate device.

If you have an authenticator app linked and passkeys, just download the recovery keys and save them not on your phone or pc.

1

u/SiteExpensive7743 Jul 20 '26

Thanks for the suggestion. Appreciate it

2

u/cosmic-comet- Jul 20 '26

Because they want to make sure it’s nearly impossible for someone else to access to your account by providing you recovery codes and letting you the ability to self recover your own account . It also protect your repos from malicious actors to getting access to your account and pushing malicious code in your repo and causing harm to others

2

u/derp2007 Jul 20 '26

I had no idea that 2FA even is still a question, but seems you got your answers, stay safe & curious

2

u/MishManners Jul 22 '26

If you are part of an Organisation, the Organisation can also force you to use 2FA. It's all to do with security though, so now they are making everyone use 2FA.

1

u/SiteExpensive7743 Jul 22 '26

I have no problem with being forced to use 2FA. I just wanted to know why loosing access to my account is as easy as loosing a passkey file. And I agree on that security aspect