4 ms·
I want to be able to freeze this. Give me 30 days to OK a bulk data download. I don't want a single lost access token to have such an easy way for someone to ge
by 3pt14159 8y ago
I want to be able to freeze this. Give me 30 days to OK a bulk data download. I don't want a single lost access token to have such an easy way for someone to get everything.
- driverdan 8y agoA single lost access token + the API is an easy way to get everything too. It doesn't take much code to get everything that way.
- 3pt14159 8y agoWell then I want that to be locked down too! I'm sick of the all-or-nothingness of many of these security measures.
- zrail 8y agoReally the lesson is to use constrained API tokens, going so far as to make single-purpose users as necessary.
- SmellyGeekBoy 8y agoThen don't create an API token with full access?
- akerl_ 8y agoA single lost access token that had global permissions already had the ability to get everything: GitHub’s API is already very full-featured. The fix here is to use their scoping as intended: it should be amazingly rare to need an access token with such broad access.
- benbalter 8y agoWhen you request an archive of your data, we send the download link to your primary email address (the required token is not available via the web UI). Once you click that link, you'll be asked to re-enter your password. So for this particular feature, an attacker would need both your GitHub password (and your 2FA seed or an active session if 2FA is enabled) and access to your email.
- jwilk 8y agoThere's also API (https://developer.github.com/v3/migrations/users/ https://developer.github.com/v3/migrations/users/), which doesn't involve web UI or email. The docs says it's "only available to authenticated account owners"; I hope it means you can't use a token for that, but I'm not sure.