you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 1 month ago (3 children)

True, but how does GitHub know your bitwarden has MFA? It only knows something has a valid credential.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 1 month ago (1 child)

    I don't think that github has to know that. You could be using a password manager and choose to make it a minimum character boring password or meet minimum complexity requirements or use the same password on a million sites. You have to secure your credentials; complying with the minimums of a service isn't security.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 month ago

    GitHub doesn't need to know that - I think that's why it's a bit of a cop out for MFA. Sure, your bitwarden may implement MFA, but just a chrome browser isn't MFA.

    Passkeys enable sites to offload the responsibility of securing accounts to the user, and if the user chooses a weaker way to implement them, GitHub doesn't give a fuck.

  • source
  • parent