<h2 id="heading-what-is-2famfa">What is 2FA/MFA?</h2>
<p>For modern digital life, it’s hard to avoid <a target="_blank" href="https://www.investopedia.com/terms/t/twofactor-authentication-2fa.asp">Two-Factor Authentication (2FA)</a>/<a target="_blank" href="https://en.wikipedia.org/wiki/Multi-factor_authentication">Multi-Factor Authentication (MFA)</a>. You may see the term 2FA and/or MFA though both apply to authentication, which is the act of verifying a user can access a website, application, or service.</p>
<p>At minimum, you need a username or email as sign-in credentials, and you need something else:</p>
<ul>
<li><p>you (biometrics)</p>
</li>
<li><p>thing (hard or soft token)</p>
</li>
<li><p>and, something you know (password).</p>
</li>
</ul>
<p>The most common MFA is when a user logs into an app they are prompted to check their email or SMS for a code. This code should be a <a target="_blank" href="https://www.twilio.com/blog/what-does-otp-mean">OTP - one-time password/passcode</a>.</p>
<h2 id="heading-use-2famfa-in-your-build-process">Use 2FA/MFA in your build process</h2>
<ul>
<li><p>First, are you using GitHub, GitLab, or BitBucket to host your code?</p>
</li>
<li><p>Enable 2FA/MFA on your account.</p>
</li>
<li><p>Enable <strong><em>verified commits</em></strong> for your developer laptop/environment.</p>
</li>
</ul>
<h2 id="heading-verified-commits">Verified Commits</h2>
<p>Next week, I’ll show you how to enable verified commits for your developer environment…because even <a target="_blank" href="https://www.bleepingcomputer.com/news/security/github-notifies-owners-of-private-repos-stolen-using-oauth-tokens/">Big Tech</a> makes mistakes. 😳</p>


## What is 2FA/MFA?

For modern digital life, it’s hard to avoid [Two-Factor Authentication (2FA)](https://www.investopedia.com/terms/t/twofactor-authentication-2fa.asp)/[Multi-Factor Authentication (MFA)](https://en.wikipedia.org/wiki/Multi-factor_authentication). You may see the term 2FA and/or MFA though both apply to authentication, which is the act of verifying a user can access a website, application, or service.

At minimum, you need a username or email as sign-in credentials, and you need something else:

* you (biometrics)
    
* thing (hard or soft token)
    
* and, something you know (password).
    

The most common MFA is when a user logs into an app they are prompted to check their email or SMS for a code. This code should be a [OTP - one-time password/passcode](https://www.twilio.com/blog/what-does-otp-mean).

## Use 2FA/MFA in your build process

* First, are you using GitHub, GitLab, or BitBucket to host your code?
    
* Enable 2FA/MFA on your account.
    
* Enable ***verified commits*** for your developer laptop/environment.
    

## Verified Commits

Next week, I’ll show you how to enable verified commits for your developer environment…because even [Big Tech](https://www.bleepingcomputer.com/news/security/github-notifies-owners-of-private-repos-stolen-using-oauth-tokens/) makes mistakes. 😳

Enable 2FA/MFA For Your Build Process

Tips + Tricks + Riffs devoted to my experiences building modern cloud applications, including monitoring and deploying Artificial Intelligence/Machine Learning (AI/ML) fullstack applications.
