Unable to disable SMS 2FA via the web interface #173759
Replies: 4 comments 5 replies
-
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
-
|
This bug has a security impact: it's preventing me from fully securing my account, which means the projects I belong to can't require secure 2FA without cutting me out. Is there any way I can escalate this issue? |
Beta Was this translation helpful? Give feedback.
-
|
@zzuegg has reported a similar issue with the GitHub web interface. |
Beta Was this translation helpful? Give feedback.
-
|
This issue is still present. Kind of ridiculous. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Select Topic Area
Bug
Body
A project I'm in decided to require secure 2FA. My account already had 2FA configured and enabled, but only the SMS/Text message option, which is considered insecure. So I added GitHub Mobile 2FA to my account, giving me two 2FA options (SMS and Mobile). I made GitHub Mobile my preferred option.
When the project's secure 2FA requirement went into effect, I lost write access to the project because my account still had an insecure 2FA option. Other project members report a "..." button in the "SMS/Text message" section of the https://github.com/settings/security webpage. That button reportedly opens a popup menu with "Edit" and "Disable" items.
I want to disable my account's SMS 2FA, but where others see a "..." button, I see an "Edit" button with no "Disable" control:
I've read the web documentation including Changing your 2FA. At the top of the page, it clearly states, "You can change your two-factor authentication (2FA) method without disabling 2FA entirely. You can reconfigure your two-factor authentication (2FA) settings or add new 2FA methods without disabling 2FA entirely, allowing you to keep both your recovery codes and your membership in organizations that require 2FA." However, it doesn't provide step-by-step instructions to disable or remove an existing method.
Copilot is vague and unhelpful. It says to locate the SMS/Text message method and click Remove. But I don't find a "Remove" control anywhere on the relevant webpage. (See the screenshot above.)
I've tried various expedients, but I've been unsuccessful at removing/disabling the SMS 2FA method from my account. I tried two different browsers: Firefox and MS Edge. I tried clicking on the "Edit" button. I tried changing my preferred 2FA method and then changing it back to GitHub Mobile.
I suspect my GitHub account is in some weird state such that SMS 2FA is enabled but the web interface doesn't allow me to disable it. I suspect this is symptomatic of a bug in either GitHub's web interface or its back end.
I tried to open a GitHub Support ticket, but Support's virtual assistant simply diverted me back to the documentation on the website. I don't know any other official channel for obtaining support.
Beta Was this translation helpful? Give feedback.
All reactions