ubuntugithubemail-verificationdeviceid

Device verification code: How does github calculate deviceId?


Whenever I try to login to github from a different ubuntu machine on the same network, it prompts me to provide a device verification code.

How does github understand that I am logging in from a different device since I am using same os/version/source-ip ?

Is there a way to spoof the deviceId so that I stop getting this prompt?


Solution

  • I don't know exactly what technique GitHub uses, but it's likely a cookie in your browser or some other sort of local storage. It is known that if you clear your cookies that the prompt will reoccur.

    This technique exists to avoid problems with weak or compromised passwords which can lead to account takeovers. An attacker would have to have both the account password and access to the email account, which is somewhat more difficult.

    There is no way to avoid this, since the goal is to ensure that you have more than just the password to log into the account. If you enable two-factor authentication, however, that will disable device verification, since you already have something more than just the password to log in.

    Even if you don't care about your account's security, GitHub does, since compromised accounts are a source of abuse and spam. This is unfortunately a global problem on the Internet today.