GitHub is the largest custodian of open-source software in the world and is used by millions of developers worldwide daily. It’s imperative GitHub provides strong security for its customers and developer communities.

Previously, GitHub has brought in support for Universal Second Factor (U2F) in 2015, Web Authentication (WebAuthn) such as FaceID or Microsoft Hello in 2019, and recently U2F and FIDO2 security keys for SSH. Examples of FIDO2 security keys include the hardware-based authenticators from Yubico or Feitian which can communicate with your devices via Bluetooth, USB, NFC, and other means.

Last week GitHub announced possibly its largest step to date regarding security, and no longer accepts password authentication for CLI operations and requires the use of stronger authentication credentials for all authenticated Git operations on GitHub.com.

This includes SSH keys for developers, OAuth or GitHub App installation tokens for integrators, or a hardware-based security key like a YubiKey or Feitian FIDO2 device.

The announcement also comes with a stronger partnership between Yubico and GitHub, including some limited edition GitHub-branded YubiKeys. GitHub users can secure their Git commits using a GPG key stored on their YubiKey, ensuring open source contributions are being made by the right users in developer communities or organisations.

GitHub research identifies over 61% of organisations have either deployed passwordless authentication or have it in a pilot phase. GitHub is helping to realise this future for these organisations with their move to support FIDO2 and the path forward to a passwordless future. It also helps to wean organisations off their reliance on SMS-based authentication, which is no longer advocated by NIST 800-63B.

You can buy a GitHub-branded YubiKey from their online store and find instructions to set it (or any other YubiKey) here, as well as instructions on setting up commit signing with digital signatures.

There's also a video guide below. With all these resources, if you're not yet embracing hardware security keys there's no reason to delay any further.