I Was Tasked With Enrolling Millions of Developers in 2FA - Here's What Happened

on YouTube ↗38m

" summary

GitHub plans to require all code contributors to enable 2FA by end of 2023 after voluntary adoption sits under 20%, and the rollout uses push-based 2FA, a new opinionated config flow and a 28‑day verification check plus a public passkeys beta for easier enrollment. Early results: a 42% drop in 2FA support tickets, 33% fewer lockout recovery attempts and a 38% rise in users downloading recovery codes, showing the UX and staged enrollment approach materially reduces incidents.

AI-written summary · about

" chapters (12)

1. 0:00TFA enrollment challenge
2. 2:49Why TFA adoption is low
3. 7:03Security versus business goals
4. 10:09Strategic planning
5. 16:34Building trust in teams
6. 20:22Pragmatic decisions
7. 23:31UX improvements before enrollment
8. 27:04Gradual rollout
9. 31:01Communicating change
10. 33:48Measuring success
11. 35:16GitHub’s TFA lessons
12. 37:26Q&A

" related talks

• 30mDeploying Two-Factor Authentication to Millions of UsersEmanuele Cesena · BSidesSF 2019
• 28mLessons on the Road to Complete Customer MFAIan Glazer · Authenticate 2022
• 17m2FA in 2020 & BeyondKelley Robinson · GOTO Chicago 2020
• 50mA tale of two sides of 2FAChristine Seeman · NDC London 2020
• 01h 28mHow to 2FA-enable Open Source ApplicationsMike Schwartz · Open Source 101 at Home 2020
• 39m2FA, WTF?Phil Nash · Codemotion Amsterdam 2016
• 23mSecuring the npm EcosystemAbigail Cabunoc Mayes · Open Source in Finance Forum New York 2022
• 24m2FA in 2020 and BeyondKelley Robinson · BSidesSF 2020