I don't use GitHub but I have difficulty believing that the standard way is not to use SSH keys, just like with every other non-local Git repository out there.
Of course you are still free to choose whichever passphrase you want for your SSH key, or even a hardware device if that's your preference.
Biting the hand that feeds IT
