Disable OTP for 2FA

[schack]

Hi
Is the possible to completely disable the OTP option for 2FA, I want to only be able to use security keys (Yubikeys)

[queenofcorgis]

Hi @schack,

You do need two forms of authentication for 2FA, but there are multiple options like GitHub Mobile authentication - you can make Yubikeys your preferred method if that helps.

[MightyBOBcnc]

It does not help, and it is ridiculous that we're forced to set up TOTP or SMS 2FA in order to use a hardware key that is more secure than both of those.

[adriankeenan]

You do need two forms of authentication for 2FA

I only had OTP 2FA before adding my security keys, so github was clearly happy to run with a single 2FA method.

This requirement just doesn't make sense. After adding my security keys, the lowest security 2FA method for my account remains the same (OTP) - so what's the point?

[schack]

I would really like to get completely rid of the less secure authentication methods, minimizing the risk of successful phishing