4 ms·
If they had an SSH key only then signing would be a defense. But if the attackers got OAuth access, stolen credentials, or a personal access token to someone wi
by morpheuskafka 7y ago
If they had an SSH key only then signing would be a defense. But if the attackers got OAuth access, stolen credentials, or a personal access token to someone with access to the org, they could do everything through the web interface which is signed by a common Github key.
- DuskStar 7y agoI trust that GitHub key less than personal keys for exactly that reason.
- akerl_ 7y agoCommits made via the UI aren’t signed at all. There is no “common github key” for signing commits
- morpheuskafka 7y agohttps://github.com/aidanh010/test/commit/ebdf858ae90ab7d3ce5928894c23a54ddcff8524 https://github.com/aidanh010/test/commit/ebdf858ae90ab7d3ce5... https://imgur.com/a/fSKnL9C https://imgur.com/a/fSKnL9C