0

I had enabled 2FA for GitHub using a mobile number. Today when I tried to log in from a different device, during the 2FA verification time, I received the code from a consumer phone number [ +91 7906173### ], stating the TOTP as "Github authentication SDT".

Being sceptical, I had opted to resend the OTP and then received a different OTP as "Github authentication code"

enter image description here

I rechecked the number with truecaller:

enter image description here

As an SOP, I have changed my password and 2FA verification method.

Can anyone help me to understand what is going on? What is "GitHub authentication SDT" and why I have received my 2FA OTP from a consumer mobile number? Are my account and the old password secured?

P.S: I have not found and suspicious SAML log-in session.

Improve this question
5
  • You are going to have to ask Github what "GitHub authentication SDT" means.
    – schroeder ♦
    Jan 24, 2022 at 13:54
  • I have asked them. But idk why they have marked it as a spam - "Our automated spam filter, Akismet, has temporarily hidden your topic."
    – Amlan Saha Kundu
    Jan 24, 2022 at 13:58
  • 1
    I agree that this is concerning, and I would certainly advise these companies to stop using random numbers, but it seems to be a common practice.
    – schroeder ♦
    Jan 24, 2022 at 14:01
  • Yeah. But can you please tell me whether there is any difference between auth SDT and the auth code?
    – Amlan Saha Kundu
    Jan 24, 2022 at 14:06
  • 1
    As I said, that's something for Github. You will have to rephrase your post to them so that it doesn't read as spam.
    – schroeder ♦
    Jan 24, 2022 at 14:15

0

Reset to default

Browse other questions tagged .