Hirsch Singhal

Identity PM for GitHub. Opinions are my own.

[Hirsch Singhal @hpsin_]

@beatngu1101 @GHchangelog It's in the plans! For now it'll be transfers, but we've got a lot of different things to "promote" to the enterprise, so we're looking at better patterns for that.

[GitHub Changelog @GHchangelog]

Pre-defined organization roles that grant access to all repositories https://t.co/7vvdwaYcwv

[Hirsch Singhal @hpsin_]

@TruBluDevil Ah. What if they don't want you to? There's a name field on GitHub even! They could just fill that out? We don't offer a way to mandate that today though.

[Hirsch Singhal @hpsin_]

@TruBluDevil Say more about how or why you'd want such a thing? ☺️

[GitHub Design @githubdesign]

Product designer Hemant Kumar discusses implementing 2FA at scale, driven by empathy for users and a commitment to security. The project showcases collaboration, design, and strategic communication. https://t.co/Y3P9utkxXK

[Hirsch Singhal @hpsin_]

@nas_bench I think you can guess why that is though, right? Should we be checking that a txt file doesn't have DICOM headers, just in case?

[Hirsch Singhal @hpsin_]

@goo @1Password That'd do it!

[Hirsch Singhal @hpsin_]

@ericwastl @github Please stay on that oauth app, it's the one with the raised limit.

[Hirsch Singhal @hpsin_]

@SwiftOnSecurity @CHECKYSTOMPER69 O.o
Now I have to go find out who Seymour is. Glad someone asked about the name.

[Hirsch Singhal @hpsin_]

@indy_singh_uk @evadne @github Thanks!

[Hirsch Singhal @hpsin_]

@evadne @indy_singh_uk @github Hm, it's at the speed of your browser's JS engine, since the button should disable as soon as the field hits 6 digits. I'll play around a bit to see what I can repro, even Chrome throttling doesn't help.

[Hirsch Singhal @hpsin_]

@cStreeks @github @GitHubSecurity But you don't have to do 2FA after you use your passkey, once you enable 2FA. It counts as both (like Google, Microsoft, etc).

[Hirsch Singhal @hpsin_]

@cStreeks @github @GitHubSecurity They don't count as 2FA in your case because you don't have 2FA enabled, and we're not going to silently enable it on people. We do require additional 2FA methods to be registered right now because we're still figuring out how often people lose their passkeys.

[Hirsch Singhal @hpsin_]

@evadne @indy_singh_uk @github Although I'll be honest I'm not fast enough to repro this. We added some logic that blocks double-use of 2FA codes, per spec, and it doesn't have debounce (which, across HTTP requests... sigh).

[Hirsch Singhal @hpsin_]

@evadne @indy_singh_uk @github Thanks for figuring this out, it helps with some of the reports we've gotten. I'll open the bug internally.

[Hirsch Singhal @hpsin_]

@johnzabroski @github Are you trying to sign in to your account? You might want to check your security log - someone might be trying to get into your account and is triggering the prompt on your device because they have your password.

[Hirsch Singhal @hpsin_]

@SPSquonK Quel est le probleme? Le nouveau design veut que tu actives 2 modes de 2FA (une cle securite et TOTP par example), c'etait un probleme dans le passe. (Desole pour mon francais)

[Hirsch Singhal @hpsin_]

@troyhunt @github This is actually the last rollout of the year, I figured we'd have hit you earlier than this. Thanks for being part of getting us here!