Secure 2FA flows are rough

[jsoref]

🏷️ Discussion Type

Product Feedback

💬 Feature/Topic Area

Other

Body

• Spun off from Article doesn't do a good job of explaining Only allow secure two-factor methods github/docs#38087

  The setting for Only allow secure two-factor methods is pretty new and the way it behaves is incredibly surprising. I've spoken to a couple of people and so far everyone has been surprised at the process to enable it and the docs are just this page which doesn't help.

  Ideally that view would warn "hey, you observer, your account has SMS enabled, you should go to https://github.com/settings/security and remove it", and ideally it would give an admin a hint about how many accounts would be impacted by this setting (there's a difference between 0, 1-5, and 1000)

• Article doesn't do a good job of explaining Only allow secure two-factor methods github/docs#38087 (comment)

  When this feature is enabled, users will be sent to a screen that might show this:
  

  Nothing in this screen hints that the solution is to remove SMS.

  The text in the docs should clearly explain this, and the UI should have a ⚠ saying something like "this option is preventing you from accessing list of organizations because they are requiring better security than this provides".

• Article doesn't do a good job of explaining Only allow secure two-factor methods github/docs#38087 (comment)

  While this is being considered for reworking, please consider also trying to communicate which sets of two-factor methods must be enabled before a user can delete their SMS method. I was surprised that two Yubikeys weren't sufficient, adding the Mobile app wasn't sufficient, and I had to configure a TOTP (or HOTP?) source. Taking two false turns before stumbling on the right answer wasn't great fun.

• Article doesn't do a good job of explaining Only allow secure two-factor methods github/docs#38087 (comment)

  Re @Habbie Article doesn't do a good job of explaining Only allow secure two-factor methods github/docs#38087 (comment)

  One of these pages should also clarify (if true, because I am not sure) that enabling 'secure' actually disables users that have SMS/text 2FA configured at all.

  Technically, that is mentioned here:

  https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/preparing-to-require-two-factor-authentication-in-your-organization

  https://github.com/github/docs/blob/7a90f722ac1f73b5e71c1043ea58e85565f13c84/content/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/preparing-to-require-two-factor-authentication-in-your-organization.md?plain=1#L23

  When you require use of 2FA for your organization, {% ifversion ghes < 3.17 %}members and {% endif %}outside collaborators (including bot accounts) who do not use 2FA will be removed from the organization and lose access to its repositories.{% ifversion fpt or ghec %} If you require secure methods of 2FA, outside collaborators who have SMS 2FA configured will be removed. {% endif %} They will also lose access to their forks of the organization's private repositories.

  Note that the text is wrong in that it says will be removed, what it means is will be put in purgatory. They're still members, they just can no longer see the repositories (including public repositories!). It's actually worse than being removed. If they were removed, they'd at least be able to see public repositories owned by the org.

• I've made a change for this: Try to explain how to deal with secure 2fa requirements github/docs#40665

  Could someone please change:
  https://github.com/organizations/:organization/settings/security

  Only allow secure two-factor methods

  Users can only use secure two-factor methods: authenticator apps, passkeys, security keys, and the GitHub mobile app. Learn more about two-factor authentication.

  -Users can only use secure two-factor methods: authenticator apps, passkeys, security keys, and the GitHub mobile app. [Learn more about two-factor authentication](https://docs.github.com/authentication/securing-your-account-with-two-factor-authentication-2fa/about-two-factor-authentication).
  +Users can only use secure two-factor methods: authenticator apps, passkeys, security keys, and the GitHub mobile app. [Learn more about two-factor authentication](https://docs.github.com/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/preparing-to-require-two-factor-authentication-in-your-organization).

  As that's the only page that at least explains that having SMS enabled is why a user will be locked out, as opposed to the current page which doesn't explain that the presence of SMS will lock a user out.

• Article doesn't do a good job of explaining Only allow secure two-factor methods github/docs#38087 (comment)

  For people wondering what the admin side looks like,

  https://github.com/organizations/:organization/settings/security

  Two-factor authentication

  Two-factor authentication adds another level of security for your organization. Learn more about requiring two-factor authentication in your organization.

  • Require two-factor authentication for everyone in the :organization_pretty_name organization.
    Organization members who do not have two-factor authentication enabled will be unable to access resources owned by the Check Spelling sandbox organization, but will remain a member of :organization_pretty_name until they update their settings. Outside collaborators who do not have two-factor authentication enabled will be removed from the organization and notified. View organization membership to see which users will be impacted.

    • Only allow secure two-factor methods
      Users can only use secure two-factor methods: authenticator apps, passkeys, security keys, and the GitHub mobile app. Learn more about two-factor authentication.

  The View organization membership link leads to a page with:
  

  There's no explanation of how and differ or what they mean.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐