Shifting to two-factor auth is hard to do. GitHub recommends the long game
Slow and steady wins this race with users Black Hat Getting people to use multi-factor authentication is surprisingly tough - or unsurprisingly, depending on your opinion of IT users. In any case, GitHub is managing it by playing the long game....