World map

 

BM

World 8: Shields: Security

2FA and passkeys

You will learn: how to lock your GitHub account with a second check.

The problem

A shop website got hacked. Your password leaked. You use the same one on GitHub. What would stop a stranger?

Watch

Tap each point on the timeline.

two-factor authentication (2FA): A second check after your password, like a code from your phone. (2FA) asks for two proofs. First your password. Then a code or a tap from something you own.

Try it

Good 2FA mixes two kinds of proof. Sort each one.

Drag a card into a box. Or tap the card, then tap the box.

      Watch

      A passkey: A sign-in key kept on your device. You unlock it with your face, finger or PIN. lives on your phone, laptop or password manager. You unlock it with your face, finger or PIN. No password to type. One step, and it counts as 2FA too.

      Predict

      A fake site looks just like GitHub. It asks you to sign in with your passkey. What happens?

      Check

      Good habit, or needs work? Swipe each one.

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      Save your recovery codes somewhere safe

      Try it

      Now lock your real account. Tick each step as you go.

      Mission: turn on 2FA

      0 of 4 steps done · Your ticks are saved.

      You did it!

      You can now lock your account with 2FA and passkeys.

      Go deeper (optional)

      GitHub requires 2FA from people who contribute code on github.com. Lost your phone and your recovery codes too? GitHub Support cannot let you back in. So guard those codes well. A passkey can sync across your devices. Or it can stay on one security key.