Hi GitHub Security Team, #212057
Hi GitHub Security Team,
#212057
Replies: 1 comment
|
Thank you for your interest in contributing to our community! We currently only accept discussions created through the GitHub UI using our provided discussion templates. Please re-submit your discussion by navigating to the appropriate category and using the template provided. This discussion has been closed because it was not submitted through the expected format. If you believe this was a mistake, please reach out to the maintainers. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
It is absurd that in 2026 GitHub still forces users to keep a password and a TOTP authenticator app or sms active on their account when multiple Passkeys and GitHub Mobile are already configured.
The entire security point of adopting phishing-resistant Passkeys (WebAuthn) is to eliminate weak, phishable credentials like passwords and 6-digit TOTP codes. Forcing us to keep both a password and a TOtP seed active in the background completely undermines the security model of Passkeys. Attackers can simply bypass the Passkey prompt and target the legacy password + TOTP fallback instead.
Could you please fix this issue?
All reactions