Dear all, if you got a scary message saying that you’ve been booted from the OCaml org, then read on. I activated ‘2FA required’, which should have only affected a couple of users. However, there’s also a followon option to ‘require secure authentication methods’ which (might) kick you out of the org if you had the SMS option active.
The SMS option is indeed insecure, so try disabling that and let me know if you need permissions restored to whatever you needed that you had before.
Unfortunately, it’s not entirely clear why some people got immediately kicked out (like @mtelvers) and others have a grace period. I suspect it’s to do with team membership, but this aspect of GitHub is entirely and frustratingly opaque. I’ll fix anyone affected if you drop me a line, with my apologies for the hassle on an otherwise lovely Friday afternoon.
The problem for me was rather loosing half and hour trying to find out how to disable it despite the fact that I had other 2fa mecanisms already enabled like the app. I couldn’t until I tried to enable totp.
yes, I just discover that you must add a new mechanism and you also must remove the SMS code one. Then, it should work (I was in the case where I had both and still have the issue).
I don’t know how the OCaml organisation is managed, but for such a systemic change, it would have been better to have had at least a heads-up beforehand.
After some digging I found the official docs stating that TOTP needs to be enabled and SMS disabled.
Also TOTP can’t be removed even if you have passkeys or security keys. It also introduces the concept of a primary 2FA and secondary 2FA (which doesn’t exist in the UI). Apparently the mobile app is a secondary 2FA (I can’t understand why, the argument about losing passkeys/security keys doesn’t apply to it).