3 ms·
I wonder if Github has ever considered allowing a 2FA via the use of the private ssh key that's used for running git push or git fetch/pull?
by u801e 7y ago
I wonder if Github has ever considered allowing a 2FA via the use of the private ssh key that's used for running git push or git fetch/pull?
- tialaramex 7y agoFiguring out what sets of unrelated operations it's safe to do with the same private key is a problem. Definitely don't do this without a cryptographer examining all the operations done and telling you it's safe. Generally if asked they'll tell you to just make a new key instead because that's definitely fine. Example: If an archaic backup MX mail server with private RSA key P is allowing SSLv3 "for backwards compatibility" then bad guys can use that to impersonate an otherwise unrelated TLS 1.3 web server that shares private RSA key P.