Disable using the GitHub mobile app as MFA

[sammcj]

It's really annoying that GitHub keeps trying to use the mobile app by default rather than my chosen MFA.

There needs to be a way to disable this for the mobile app.

ℹ️ Additional Debug Info

GitHub for iOS, Version 1.77.0 (76215101) Device: iPhone 12 Pro (iOS 16.0)

[taki-on]

Hi @sammcj the issue is known to us, and we are currently working on better 2FA experiences regarding the user's authentication app setting. Please stay tuned!

[eliperkins]

Thanks for your feedback! Today, we've shipped a new feature that allows for setting a preferred option for two-factor authentication. This will allow you to set other two-factor authentication methods to be used before another option. Go to Settings > Password and Authentication on GitHub.com in your browser to set a different preferred two-factor option.

Additionally, GitHub Mobile sessions can be revoked within Settings as well:

[lriley2020]

Is there a way I can completely disable this method all together? Whilst the "preferred method" option does mean that I don't have to deselect github mobile as the was to authenticate myself each time I log in, I do not want it to be available as a 2FA method for accessing my account at all. In my opinion, it weakens the security of the 2FA method that I actually want (security key) by offering potential attackers an easier way to attack my account. Please stop forcing this weaker github mobile 2FA on people and allow the users to choose their own 2FA methods, whilst still using the mobile app as normal. At the moment, the only workaround to this is to not use the mobile app, which is much less convenient for many users.

[cuducos]

Please stop forcing this weaker github mobile 2FA on people

That. Please.

[SjoerdV]

I agree with @sammcj and @lriley2020 especially since:

• a dedicated authenticator app is preferred (not mixing content and security). I really dislike the Outlook app for that as well!
• the Github mobile app does not have a 'TouchId' (or other biometric / password) setting in the App, making it insecure in itself (at least Outlook has this covered)
• I don't like 'everything' apps, they are security and privacy nightmares

I will go as far as removing the App from all my devices and use browser only, if this is not fixed within a reasonable time frame. Thanks!

[ErikAGriffin]

it weakens the security of the 2FA method that I actually want (security key) by offering potential attackers an easier way to attack my account

Hi, I agree with all the above allowing Github mobile and SMS as multi-factor options reduces the overall security of the account.

My multi-factor app of choice forces authentication on opening. The above two are already accessible if the phone has already been unlocked, such as handing it to someone to make a phone call, check directions, etc.

@eliperkins while the option to set a preferred method improves the user experience, there is a still a security bug here: Users need the option to disable mulit-factor methods as it improves the overall security of the account.