Company
Date Published
Author
Neil Matatall
Word count
937
Language
English
Hacker News points
None

Summary

The "Recover Accounts Elsewhere" feature allows GitHub users to associate their accounts with their Facebook profiles to facilitate account recovery in scenarios where two-factor authentication methods become inaccessible, such as losing a phone or U2F key. By integrating with Facebook, GitHub provides an alternative proof of account ownership that complements traditional methods like confirmed email access and valid SSH keys. The underlying "Delegated Account Recovery" process involves encrypting and digitally signing a recovery token, which Facebook stores securely until needed. During a recovery, Facebook countersigns the token, which GitHub then verifies to confirm the account owner's identity without exchanging any personally identifiable information between the platforms. This approach aims to improve security and privacy by mitigating risks associated with database dumps and SQL injection vulnerabilities, while GitHub also plans to open-source a Ruby library to assist in implementing this recovery process. The feature is part of a joint bug bounty program with Facebook to ensure ongoing security improvements and is seen as a potential replacement or complement to traditional password resets. Moreover, future plans include reciprocal recovery options between Facebook and GitHub, enhancing the overall account recovery process.