Able to change Two Factor settings without (re)entering password.

[PBXg33k]

I would expect the TFA settings to be handled the same way as the SSH keys settings regarding to security/sensitivity.

I noticed i was able to change my TFA device without having to validate my account as it was already logged into on my private machines. In my case i needed to update my TFA device since it got replaced, but i would image it could be possible for someone with less genuine intentions to take over an account if it were logged in on a device.

Adding SSH keys always require the user to enter his/her password in order to authenticate the user, even if the user's already logged in. Shouldn't TFA be handled the same way?

[PBXg33k]

Contacted GitHub regarding this and received the following response. Sent a follow up mail, waiting for response.

Hey there,

Thanks for reaching out!

After a period of inactivity, you'll be prompted to enter your password anytime 
you attempt to view sensitive account or repository settings. After that password 
is provided, it's not necessary to enter it again unless another period of inactivity occurs. 
This is described here:

https://help.github.com/articles/sudo-mode

If you entered your password at all in the hours leading up to accessing your account's 
two-factor authentication settings, you should not have been prompted for a password - 
your account would already have been in Sudo mode.

Should you have any lingering questions or concerns, don't hesitate to let me know!

Best,
{redacted}

[KLuuKer]

I can confirm the same problem exists for me. Here is a snippet from my security log, I tried it on a browser that hasn't had GitHub open that day and was logged in on a while back. And when attempting to add ssh keys to my account it will prompt me for a password (which I did not enter) so sudo wasn't in effect.

Security History	age
two_factor_authentication.enabled – Originated from b.b.b.b	2 days ago
two_factor_authentication.disabled – Originated from b.b.b.b	2 days ago
user.two_factor_recovery_codes_downloaded – Originated from b.b.b.b	2 days ago
repo.create – KLuuKer/EndpointRoutingDemos	20 days ago
user.login – Originated from a.a.a.a	20 days ago
user.two_factor_challenge_success – Originated from a.a.a.a	20 days ago