Hot Topics

Home » Cybersecurity » SBN News » GitHub now supports two-factor authentication with security keys using the WebAuthn API

GitHub now supports two-factor authentication with security keys using the WebAuthn API

by Bhagyashree R on August 22, 2019

Yesterday, GitHub announced that it now supports Web Authentication (WebAuthn) for security keys. In addition to time-based one-time password (TOTP) applications and text messages, you can now also configure two-factor authentication using a security key.

Remember when fingerprint authentication seemed like the future?
Starting today, secure access to your code with a fingerprint, facial recognition, and more.
Two-factor authentication that’s more secure and easier than ever to use🔒https://t.co/VUEQenjERD
— GitHub (@github) August 21, 2019

WebAuthn is a standard by W3C that uses a public key instead of passwords or SMS texts for registering and authentication. It leverages strong authenticators that come built into devices like Windows Hello or Apple’s Touch ID. The purpose behind WebAuthn is not only to address security problems like phishing and data breaches but also significantly increase ease of use.

Citing the reason behind bringing this support, Lucas Garron, GitHub’s Security Engineer, wrote in the announcement, “Account security is critical for GitHub. Although we support strong authentication options, many people still don’t use a password manager or two-factor authentication because individual passwords have always been the easiest choice.”

You will be able to use physical security keys on GitHub if you are using the following:

Firefox and Chrome-based browsers on Windows, macOS, Linux, and Android
Edge users on Windows
Brave on iOS using the new YubiKey 5Ci
Safari Technology Preview on macOS

GitHub also allows using your laptop or phone as a security key if you do not want to carry an actual physical key. For this, you are required to register your device first. People using Microsoft Edge on Windows can register their device using Windows Hello with facial recognition, fingerprint reader, or PIN. Chrome users on macOS can use Touch ID, while on Android they can use the fingerprint reader to register their device.

Sponsorships Available

Currently, security keys are secondary to authentication with a TOTP application or a text message. As more platforms start supporting security keys, GitHub plans to eventually make them the primary second factor. “Because platform support is not yet ubiquitous, GitHub currently supports security keys as a supplemental second factor. But we’re evaluating security keys as a primary second factor as more platforms support them. In addition, WebAuthn can make it possible to support login using your device as a “single-factor” security key with biometric authentication instead of a password,” Garron said.

This announcement got mixed reactions from users. While some think that security keys are future of online authentication, others believe that we are better off with just a plain username-and-password authentication. The concerns users have for fingerprints and other biometric means for authentication is that they are not really a secret and if in case they are compromised there is no way to reset them.

Better get plain username-and-password authentication working again without disturbances (“Please verify your device”), as it used to be in the pre-MS days
— probono (@probonopd) August 21, 2019

Those supportive of this step are excited about the ease of use WebAuthn brings. A user on Hacker News commented, “This is fantastic. I look forward to finally having much easier authentication on the web. Imagine browsers syncing between devices a single encryption key that will authenticate you to all sites, which you can easily back up to a piece of paper.”

Another user suggested, “In a somewhat related vein: it would be really fantastic if Github allowed the same SSH key (in my case: a Yubikey-resident SSH key) on multiple accounts; we use separate accounts for different clients, and Github’s refusal to allow an SSH key to be used on multiple accounts means I can’t use Yubikey SSH keys for those.”

If you’d like to add support for security keys as an authentication option for your web service, you can use a JSON. Check out the official announcement by GitHub to know in detail.