GitHub releases results of 2FA push to secure world's software development

GitHub says the initial achievements of this initiative will have a long-lasting impact on ensuring the software ecosystem is more secure.

As well as a dramatic increase in 2FA adoption on GitHub.com, focused on users who have the most critical impact on the software supply chain, GitHub has seen a net reduction in 2FA-related support ticket volume. Further, other organisations like RubyGems, PyPI, and AWS joined in raising the bar for the entire software supply chain. GitHub says not only is this an important security step for the industry as a whole, but also proves large increases in 2FA adoption aren't an insurmountable challenge.

GitHub chief security officer Mike Hanley said, “though technology has advanced significantly to combat the proliferation of sophisticated security threats, the reality is that preventing the next cyberattack depends on getting the security basics right, and efforts to secure the software ecosystem must protect the developers who design, build, and maintain the software we all depend on."

{loadposition david08}

“As the home to the world’s largest developer community, GitHub is in a unique position to help improve the security of the software supply chain. In May 2022, we introduced an initiative to raise the bar for supply chain security by addressing the first link in that chain–the security of developers. Because strong multi-factor authentication remains one of the best defenses against account takeover and subsequent supply chain compromise, we set an ambitious goal to require users who contribute code on GitHub.com to enable one or more forms of 2FA by the end of 2023."

“What followed was a year’s worth of investments in research and design around the implementation of these requirements, to optimize for a seamless experience for developers, followed by a gradual rollout to ensure successful user onboarding as we continued to scale our requirements. While our efforts to ensure developers can be as secure as possible on GitHub.comdon’t end here, today we’re sharing the results of the first phase of our 2FA enrollment, with a call for more organizations to implement similar requirements across their own platforms,” Hanley added.

Since GitHub began rolling out mandatory 2FA in March 2023, it has seen an opt-in rate of nearly 95% across code contributors who received the 2FA requirement in 2023, and enrollments continue to trickle in. Moreover, this has led to a 54% increase in 2FA adoption among all active contributors on GitHub.com. 

A key area of focus for this initiative was encouraging users to adopt more secure means of 2FA, especially passkeys which currently offer the strongest mix of security and usability. Since GitHub released passkeys to public beta in July 2023, nearly 1.4 million passkeys have been registered on GitHub.com. Even more impressive, passkeys rapidly overtook other forms of Webauthn-backed 2FA in day-to-day usage.

While GitHub is bullish on passkeys, the site continues to support SMS as a 2FA option for those who may not be able to adopt other factors but has intentionally made design choices in 2FA onboarding workflows to encourage users to adopt more secure alternatives where possible. This work reduced the overall share of SMS as a second factor by almost 23% between early 2023 and early 2024. GitHub sees a future where passkeys are the first choice for the majority of developers on the platform.

Finally, as a result of GitHub’s improved enrollment experience and passkey rollout, data shows that it’s 47% more likely users will configure two or more forms of 2FA. Each additional factor makes it far less likely that a given user will lose all their factors and end up locked out, resulting in a smoother and more reliable user experience.

GitHub invested in a number of improvements including refreshed 2FA onboarding flows, adding GitHub Mobile 2FA, and more user options in terms of primary 2FA factors, to help developers employ strong account security while maintaining our promise of a seamless user experience. While one would reasonably expect an increase in 2FA-related support tickets as the relative usage increased on the platform, GitHub saw the opposite. Because of the significant investments in user experience and design ahead of the rollout, GitHub saw a one-third reduction in 2FA-related support tickets. 

Further, additional internal workflow optimization and automation for GitHub’s support teams led to a 54% reduction in 2FA account recovery support tickets that require significant human intervention. Today, more than 75% of account recovery tickets come through the in-product workflow, which collects recovery details from users and automatically checks for risk factors, as well as safe scenarios (like doing account recovery while you’re still signed in). This data collection and vetting dramatically reduces the time it takes for Support teams to review these recovery attempts, allowing locked out users to safely get back to their accounts faster than ever and enabling GitHub to scale 2FA enrollment to millions of users.

GitHub also introduced a 2FA verification check-up that occurs 28 days after 2FA setup, to ensure users have an opportunity to verify their configuration. This check-up was a failsafe that helped 25% of users successfully reconfigure their accounts if they made a mistake or lost a factor, thereby avoiding account lockout for the user and significantly reducing account recovery support volume for GitHub.

While the primary focus of GitHub's 2FA push was to secure developers on its platform, it has been intentionally transparent with the goal of inspiring more organisations to take up the call. GitHub's activity shows it's possible to raise the bar for security significantly, without negatively impacting user experiences.