3 ms·
What the page doesn't tell me is: What is their definition of an "affected" account? Obviously one where an attempt was made, and succeeded, would count as aff
by natch 10y ago
What the page doesn't tell me is: What is their definition of an "affected" account?
Obviously one where an attempt was made, and succeeded, would count as affected.
But would an account where an attempt was made, and failed, also count?
What if the userid and password are correct, but 2FA stopped the attack on an account. Is that account affected, in their view?
- paulannesley 10y ago> But would an account where an attempt was made, and failed, also count? I wouldn't think so. There must be countless incorrect password attempts all the time. > What if the userid and password are correct, but 2FA stopped the attack on an account. Is that account affected, in their view? Interesting question. I'd hope they'd inform me if somebody had my password and was only blocked by 2FA.
- DanCardin 10y agoWouldnt you have gotten unexpected 2fa notifications if that were the case?
- nathankleyn 10y agoThis is true only if you use SMS for 2FA. For either method, you can audit the activity of your account on the GitHub security page: https://github.com/settings/security https://github.com/settings/security. For example, upon having deliberately got my 2FA token wrong, "user.two_factor_requested" and "user.failed_login" events were logged for me.
- eric_h 10y agoInteresting, I'd never checked that log before, and I just noticed a failed login (though no two_factor_requested) from an IP address in Brazil. I'm gonna change my password just in case.
- qnk 10y agoMy guess is that all affected accounts are those that had multiple successful and/or unsuccessful login attempts coming from the same source.