Online services, like GitHub, have Sudo mode. Sudo mode means, that a user performing delicate actions has only to authenticate every couple of minutes, but than again, although they are already logged in.

GitHub uses for this reason the user's password. I wonder if this is the best approach. Why should I use the password and not the one time password provided by an authenticator like Google Authenticator? Would that not be more secure? Especially, most browsers save the password and provide them in the password field while the one time password can not be provided per design?

  • Would you have sudo mail you a one-time password that you would have to enter to gain privileges? – Mukesh Sai Kumar Jan 15 '18 at 15:38

A second factor is not inherently more secure than a password. In many cases (like an RSA SecurID Token) the second factor is vulnerable to physical theft - whereas a memorized password isn't.

It would be more secure to ask for both authentication factors. I imagine github have chosen not to do this for convenience - after-all this is re-authenticating a user who has already successfully authenticated with both factors. You could argue the active session is already a secondary form of authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.