GitHub Begins Gradual Rollout of Mandatory Two-Factor Authentication Starting March 13

GitHub announced a gradual rollout of a mandatory two-factor authentication (2FA) requirement for code contributors, beginning March 13. According to the company, the initiative aims to improve account security and protect the software supply chain against social engineering and account takeover attacks.

Rollout and Notification Process

Starting March 13, GitHub will reach out to groups of developers and administrators in phases over the course of the year.

• Email Notifications: Selected accounts will receive an email approximately 45 days before their specific deadline.
• Dashboard Banners: Users will see a reminder banner on GitHub.com guiding them through the onboarding process.
• Grace Period and Snooze Options: After the deadline passes, users will be prompted to enable 2FA upon access. A one-week snooze option is available, which only begins after signing in post-deadline to accommodate vacations or time away.

Platform Enhancements and Security Options

GitHub has introduced several platform features to assist with the transition and prevent account lockouts:

• Multiple Methods: Users can register both an authenticator app (TOTP) and an SMS number simultaneously, though security keys and TOTP apps are strongly recommended over SMS.
• Preferred Method Selection: Developers can choose their preferred 2FA method for logins and sudo prompts.
• Post-Setup Validation: A prompt appears 28 days after setup to verify that 2FA is functioning correctly, offering a shortcut to reset configurations if needed.
• Email Unlinking: Users locked out of an account can unlink their email address to start fresh with a new account.

Verification and Next Steps

Users who wish to enroll proactively rather than waiting for an early enrollment group notification can do so directly through the GitHub interface. To verify official announcements and updates, users should check the official GitHub Blog.