GitHub is the largest custodian of open-source software on the planet, with millions upon millions of projects and users depending upon it. The company says it "is committed to keeping our platform secure and enabling developers to secure their accounts. One way we’re doing that is by helping more developers adopt two-factor authentication (2FA) for their accounts. Over the past year, we’ve led the way in improving developer account security with the introduction of support for security keys as an authentication mechanism for git operations and enforcing two factor authentication for all npm publishers."

Today GitHub announced that GitHub Mobile on iOS and Android can now also be used as an easy-to-use two-factor authentication mechanism, alongside its existing security options, and fully baked into the GitHub services you already use.

If you have 2FA configured on your GitHub account and the mobile app installed you can simply update to the latest version of GitHub Mobile in the App Store or Google Play Store to start using Mobile 2FA immediately.

If you’re not already using the mobile app you can install it now and sign in to your account. If you aren't using 2FA already you can set it up via your account security options. You'll need to use another mechanism first, like time-based one-time passcode, in order to use mobile 2FA.

Either way once set up, you’ll receive a push notification to your mobile device when you sign in to your GitHub.com account on any browser. You can approve or reject the sign-in attempt. If you approve it, you’ll be logged in to GitHub.com immediately.

If you already set up 2FA with a security key, GitHub will use that as the primary two-factor authentication channel. Security keys such as those by Yubico or Feitian provide the strongest available protection of your account credentials.