GitHub announced today the introduction of passwordless authentication support in public beta, allowing users to upgrade from security keys to passkeys.
You’re supposed to have multiple devices (phone, tablet, laptop, desktop, etc) that all store your passkey securely (it can’t just be sitting on the SSD…). You’re also supposed to backup your passkey.
Yes, if you lose access to all your devices it could prove challenging to access GitHub… but that’s a pretty unlikely scenario and most people should be willing to pay the price (what self respecting programmer travels anywhere without two or three devices?)
You are also supposed to backup everything you have on GitHub elsewhere… so it shouldn’t be a total disaster if you lose access. It’d just be annoying. And presumably GitHub has some kind of recovery process for someone who’s lost access to an account? What if the repository maintainer dies? Someone else has to be able to take over.
On the other hand - if my bank required a passkey… then I’d probably switch banks. If all my stuff is stolen or destroyed, I still need access to my money. And if someone compromises my bank… well it’s just money. The stakes are far higher if a popular GitHub repository is compromised.
As someone who works with people too stupid to log in to github without having to reset their password every time and having to take a full hour to figure out how to use their recovery method, that’s going to be a pain in the butt. I can foresee lots of "hey, quick question"s if they really do phase out simpler login methods. It’s good to have options for sure, but the standard login method should stay imo
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !programming@programming.dev
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person’s post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
Follow the programming.dev instance rules
Keep content related to programming in some way
If you’re posting long videos try to add in some form of tldr for those who don’t want to watch videos
You’re supposed to have multiple devices (phone, tablet, laptop, desktop, etc) that all store your passkey securely (it can’t just be sitting on the SSD…). You’re also supposed to backup your passkey.
Yes, if you lose access to all your devices it could prove challenging to access GitHub… but that’s a pretty unlikely scenario and most people should be willing to pay the price (what self respecting programmer travels anywhere without two or three devices?)
You are also supposed to backup everything you have on GitHub elsewhere… so it shouldn’t be a total disaster if you lose access. It’d just be annoying. And presumably GitHub has some kind of recovery process for someone who’s lost access to an account? What if the repository maintainer dies? Someone else has to be able to take over.
On the other hand - if my bank required a passkey… then I’d probably switch banks. If all my stuff is stolen or destroyed, I still need access to my money. And if someone compromises my bank… well it’s just money. The stakes are far higher if a popular GitHub repository is compromised.
As someone who works with people too stupid to log in to github without having to reset their password every time and having to take a full hour to figure out how to use their recovery method, that’s going to be a pain in the butt. I can foresee lots of "hey, quick question"s if they really do phase out simpler login methods. It’s good to have options for sure, but the standard login method should stay imo