Re: Github and two-factor authentication

[bill-auger]

On Thu, 19 May 2022 19:13:15 -0400 Richard wrote:
> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
> 
>   > It seems like you can pair whatever TOTP program you choose to your
>   > GitHub account without using github.com and its nonfree JavaScript.
>   > The situation might change when they actually start requiring
>   > two-factor authentication, but it seems okay to me for right now.  
> 
> That's a relief.  Thanks for checking.

it is not great though, at least currently - in practice, the effect is to
encourage the use of non-free software - most people are going to reach for
their non-free mobile phone and install a non-free "app" to get over this
hurdle - there are few options which run on real computers, and fewer which are
libre

when github started requiring the extra TOTP password, i looked for a
work-around which did not require a cell phone - AFAIK, there were no programs
in the repos of our libre distros which accomplish that task specifically or in
a user-friendly way - since only about a month ago, parabola now has one which
may do the job ('cotp'); though i have not tried it - it claims to be
user-friendly; but it is a CLI-only tool, so some may disagree with that claim
on principle that there is no GUI - i dont know that any other libre distros
have such a tool though

i settled on a simple command-line solution that i contrived using 'oathtool' -
in case anyone is interested, this is how to do it - the same (approximate)
procedure works generally for most websites which require TOTP login

https://wiki.parabola.nu/Libre_TOTP