Summary

In August 2019, GitHub added support for Web Authentication (WebAuthn) security keys, a shared standard for secure authentication on the web. WebAuthn allowed customers to use physical security keys, or in some specific cases, in-device biometric verification as a second factor when logging in to GitHub. At the time, we wrote:

Because platform support is not yet ubiquitous, GitHub currently supports security keys as a supplemental second factor. But we’re evaluating security keys as a primary second factor as more platforms support them. In addition, WebAuthn can make it possible to support login using your device as a “single-factor” security key with biometric authentication instead of a password. Although we’re not ready to announce further plans, we’ll continue to pursue ways to make secure authentication as easy as possible for everyone on GitHub.

As adoption of the WebAuthn standard has become more ubiquitous, we are now able to expand our support for WebAuthn. With "passwordless" WebAuthn, you can log in to github.com using biometric verification such as TouchID or Windows Hello, without needing to type in a password. Logging in with an identity tied to a trusted device is more secure, as it is more resistant to phishing and social engineering attacks. "Passwordless" WebAuthn can also be used to confirm risky actions through biometrics across devices.

Intended Outcome

1. Customers can login from a trusted device using Touch ID, Face ID, or Windows Hello via their web browser
2. Customers can confirm risky actions ("sudo") using Touch ID, Face ID, or Windows Hello via their web browser

How will it work?

Upon logging in for the first time from a device that contains a platform-based WebAuthn authenticator (e.g., TouchID, FaceID, or Windows Hello), customers will be prompted if they would like to trust the device. Logged in customers will also be prompted to trust devices when confirming potentially risky actions ("sudo") with their password.

Once a device is trusted, customers can log in to GitHub.com or confirm potentially risking actions through a biometric gesture, without needing to enter their password. Trusted devices can be managed via the account security settings page.