I personally am fine with this.

    • vinniep@lemmy.world
      link
      fedilink
      arrow-up
      53
      arrow-down
      1
      ·
      1 year ago

      Too many people were making poor choices. When there’s an incident of an account that should have been secured but wasn’t getting compromised, that’s bad for the platform, ecosystem, and community. This is just another level beyond not allowing you to set a password of “password”

    • Sibbo@sopuli.xyz
      link
      fedilink
      arrow-up
      7
      ·
      1 year ago

      Yep. If people care about supply chain attacks or so, just add features that allow only commits from accounts with 2FA to certain repositories.

    • progandy@feddit.de
      link
      fedilink
      arrow-up
      5
      ·
      1 year ago

      At least you should be able to use your local password manager as well if you don’t care about keeping your 2fa on separate hardware. KeePass 2, KeePassXC, Bitwarden, …

    • 30p87@feddit.de
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      Though people that have authority over important projects should have proper security, considering how large the internet is, with how many individual parts, the chance of someone being in charge of a large and important project - may it be a browser, compiler/interpreter, utility, library etc. is not even close to zero.
      So if a (co-)maintainer of a project included as standard utility in Linux Servers, let’s say bash for example, is somehow breached, the attacker could push and force merge a malicious obfuscated commit, maybe even with normal content included. As it’s from a reputable source, it’s not going to be checked as thoroughly as commits from other people. One hour later, every Arch system, desktop and server, has a trojan. Four hours later also all Gentoo systems (got to compile it first). 2 years weeks later regularly updated debian servers now contain malware. A chain of events, fragile to being detected by people monitoring their own activity, other maintainers activity and people reading the source - eg. for security reasons -, but yet, not that unlikely considering the amount of packages present even in a standard install, and needed as dependencies for typical server packages.

    • vanontom@geddit.social
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      Bitwarden has 2FA (for paid tier, like $10/year). I don’t consider it “real” 2FA, but it’s more secure than just a password, and super quick to copy code using browser addon. Useful for certain sites, that don’t stay logged in, require every time, etc.

      • SkaveRat@discuss.tchncs.de
        link
        fedilink
        arrow-up
        4
        ·
        1 year ago

        how would they track you?

        The reason they want a phone number is, that it’s a relatively cheap way to ensure people not signing up bots galore, as getting phone numbers en masse is a lot harder than getting email accounts

        • Otome-chan@kbin.social
          link
          fedilink
          arrow-up
          3
          arrow-down
          7
          ·
          1 year ago

          phone numbers are typically tied to your name/identity, and phone companies can locate you using their towers and such. Giving a company your phone number is identical to giving a company your full legal name and address.