GitHub moves to passwordless; requires stronger 2FA like the YubiKey

GitHub has been a longstanding supporter of strong security for its customers and developer communities. From its most recent support for using U2F and FIDO2 security keys for SSH, to its 2019 announcement of Web Authentication (WebAuthn) support for security keys and 2015 Universal Second Factor (U2F) support, the company has continued to give its millions of customers the ability to protect their accounts and projects through the use of hardware-based YubiKey authentication.

But last week marked perhaps one of the largest steps the company has taken to date GitHub announced that as of August 13, 2021, it no longer accepts Git password authentication account passwords when authenticating Git CLI operations and will require the use of stronger authentication credentials for all authenticated Git operations on GitHub.com. This includes  SSH keys (for developers), OAuth or GitHub App installation token (for integrators), or a hardware-based security key, such as a YubiKey. 

This announcement also comes with the continued partnership between Yubico and GitHub — as well as some really sweet limited edition GitHub branded YubiKeys. GitHub users can secure their Git Commits using a GPG key stored on their YubiKey. This is a crucial way to ensure that open source contributions are being made by the right users in developer communities or organizations.

There is strong momentum with FIDO2, WebAuthn, and passwordless – more than half (61%) of the organisations surveyed in a recent 451 Research and Yubico report have either deployed or have passwordless authentication in pilot (34% of respondents have already deployed passwordless technology, 27% in pilot). GitHub is helping to realise this future for these organisations with their move to support FIDO2 and the path toward a passwordless future to address traditional MFA pain points.

But not all forms of MFA are created equal when it comes to supporting organisations in the transition to passwordless. YubiKeys are designed to meet and evolve with your security infrastructure and can be deployed in passwordless environments with our IAM partners as a smart card or a FIDO2 security key, for example.

If you’re seeking further information on setting up your YubiKey with GitHub for commit verification and for SSH based Authentication please Yubico's joint whitepaper, watch the step by step video guide, or reach out via https://pages.yubico.com/github.html.