Enable 2FA requirement for OpenStreetMap Github organisation

[Firefishy]

We should enable the 2FA requirement for the OpenStreetMap Github organisation.

The following users need to enable 2FA on their account or will they will automatically be removed from https://github.com/openstreetmap when the 2FA requirement is enforced.

I propose 1st August 2021 as the deadline to enable 2FA.

• @Krakonos Ladislav Láska
• @scrosby Scott Crosby
• @bastik bastik
• @woodpeck Frederik Ramm
• @podolsir Igor Podolskiy
• @openstreetmap-mirror OpenStreetMap Mirror
• @stoecker Dirk Stöcker
• @LambertusIJsselstein LambertusIJsselstein
• @frafra Francesco Frassinelli
• @xamanu ǝɹʇʇɐʃǝ◖ xıʃǝɟ
• @systemed Richard Fairhurst
• @simonpoole Simon Poole
• @nomoregrapes Gregory
• @lonvia Sarah Hoffmann
• @marcu Ducobu Marc
• @mcauer Michael Auer
• @tatsvc Tatiana Van Campenhout
• @Nakaner Michael Reichert
• @RobJN RobJN
• @rabidllama Adam Rousell
• @ChristineKarch Christine Karch
• @lectrician1 Seth Deegan
• @josmmirror josmmirror

[tomhughes]

Being a member of the organisation doesn't actually mean much - many of the people with access to particular repositories are not organisation members because of the nature of the org as a mixture of projects.

[Firefishy]

Being a member of the organisation doesn't actually mean much - many of the people with access to particular repositories are not organisation members because of the nature of the org as a mixture of projects.

The list is all users who have permission to any repo under the openstreetmap organisation, regardless of organisational membership.

[grischard]

One common objection will be that some of these are bot or shared accounts, like @josmmirror or @openstreetmap-mirror, or that it needs one particular phone.

You don't you need to link just one device, but can instead use the oathtool cli tool. The "secret" is a long string which the QR code contains.

> oathtool --tot -b eiLiN4oafohfaof2
053648

[Firefishy]

One common objection will be that some of these are bot or shared accounts, like @josmmirror or @openstreetmap-mirror, or that it needs one particular phone.

If using automation, use git over ssh with an ssh key or use a personal access token if you need github API access, both of which do not require a 2FA login tokens.

[Krakonos]

Enabled.

[pantierra]

Enabled.

[lectrician1]

Enabled

[simonpoole]

Enabled

[Firefishy]

15 to go...

[ChristineKarch]

Done :)

[Firefishy]

@scrosby @bastik @podolsir @openstreetmap-mirror @stoecker @LambertusIJsselstein @frafra @marcu @mcauer @tatsvc @Nakaner @rabidllama @josmmirror Please enable 2FA on your accounts when you have a chance.

Why force 2FA? We have some critical project repos under the https://github.com/openstreetmap/ project, 2FA can only be enforced at the top project level. 2FA gives us another important layer of protection against account compromise.

[Firefishy]

@scrosby @bastik @podolsir @openstreetmap-mirror @stoecker @LambertusIJsselstein @frafra @marcu @mcauer @tatsvc @Nakaner @rabidllama @josmmirror Reminder, please enable 2FA on your Github accounts, alternatively let us know if you are ok being removed from the https://github.com/openstreetmap/ github project. Happy to help if needed.

[marcu]

Done !

[grischard]

JOSM ticket for this: https://josm.openstreetmap.de/ticket/21128

[Firefishy]

@scrosby @bastik @podolsir @openstreetmap-mirror @stoecker @LambertusIJsselstein @frafra @mcauer @tatsvc @Nakaner @rabidllama @josmmirror This is important...

I am the bully enabling the 2FA on the @openstreetmap github project. Other projects have had accounts compromised and exploit commits snuck in. Applying security after a compromise is too late.

Enabling 2FA on an account should not disrupt git actions in any way [1].
The 2FA is only required when login into github UI or API. If the account needs access to the Github API, it should be using a Github Personal access token, which is separate and unaffected by 2FA.

Github supports saving a backup 2FA recovery key offline (e.g: print-out). It also supports using a SMS as a backup recovery method, if desired.

The 2FA tokens are generated from a shared secret which can be decoded from the QR code from setup stage. I normally save a copy of the QR photo.

I used oathtool --totp -b *SECRET* on the command line. Share the secret with others if they also need 2FA codes, as per how you do with a shared account password.

1: As long as you are using SSH key for authentication in git, which you should be using.

[Nakaner]

Done. It can be considered state of the art to use two-factor auth but I was just too lazy to add it to my account so far.

[Firefishy]

I have now enforced 2FA on the @openstreetmap organisation.

The following users have been automatically removed because they do not currently have 2FA enabled on their accounts:
@scrosby @bastik @podolsir @openstreetmap-mirror @stoecker @LambertusIJsselstein @frafra @mcauer @tatsvc @rabidllama @josmmirror

Happy to add back any of the users above once 2FA has been enabled on their account. Message me or email operations "AT" osmfoundation "DOT" org