5 ms·
2FA is great for the web UI, but none of these vendors make it particularly easy to enforce 2FA on the command line.
by ralph84 7y ago
2FA is great for the web UI, but none of these vendors make it particularly easy to enforce 2FA on the command line.
- nathanaldensr 7y agoExactly. PATs are designed to circumvent human intervention (MFA) for authentication in order to support automation. I am very curious if there's a better way than PATs.
- deleted 7y ago[deleted]
- nhumrich 7y agoAn ssh key is 2FA
- michaelmior 7y agoHow so? An SSH key is a single factor. You could argue that a password-protected private key provides a second factor, but that still falls in the category of "something you know."
- will4274 7y agoHow many people can recite their SSH key? Surely an SSH key is "something you have".
- wnevets 7y agoHaving two different static passwords on an account isn't actually two different factors, whether you can recite them or not. The fact that one time passwords expire and change is what makes them a different factor than a static password.
- thaumasiotes 7y ago> The fact that one time passwords expire and change is what makes them a different factor than a static password. If you're getting your 2FA code by SMS message or the like, this can be true. If you're using TOTP (e.g. Google Authenticator), that's just as static as your other passwords. The TOTP code never expires nor changes. What changes is the code you're supposed to send over the wire.
- theamk 7y agoEh? TOTP usually expire in 60 seconds, so in most cases even if you accidentally leak it, it will be safe. (and you are not likely to leak it anyway -- with something that changes that often, you are not going to have an incentive to write it to files)
- thaumasiotes 7y agoA 60-second TOTP code is a fully deterministic function of a permanent, unchangeable secret. That's why you and the server can agree on what the code should be without needing to communicate beyond setting up the code originally. This makes it identical to a password from a theoretical perspective. There's really no difference between a TOTP secret that you keep in a TOTP app and haven't memorized, and a password you keep in your password manager and also haven't memorized. Both are "something you know", and nothing else. You're correct that leaking a temporary code from a single login attempt doesn't compromise the TOTP secret. That is an artifact of the login process, not of whether the mechanism is labeled "2FA" or "password". You can do the same thing while calling the secret a password: https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...
- thaumasiotes 7y agoA TOTP challenge is also "something you know", which is a really large portion of total "2FA".
- ralph84 7y agoAn SSH key is one factor. There are various methods for protecting the key with additional factors, but none of the git hosts provide a way to require those additional factors. So as an org owner you're left either trusting every one of your users not to get sloppy with keys, or installing spyware on their computers to make sure they're not using unprotected keys.
- mplewis 7y agoI use Krypt.co. It stores my private key in my mobile device only. I can hook up any device to use it as my SSH key, but the key never leaves the device. Instead, it signs all requests only once I authorize them interactively.