3 ms·

> we use separate accounts for different clients Why though?

• tptacek 7y ago
  Because it would be crazy to link all our different clients to our personal Github accounts, or really to any single Github account.
  • DangitBobby 7y ago
    GitHub recommends using a single account, according to their website[0]... I get that it could be seen as a security concern, but I don't know if it's crazy. I only accept a physical key as 2FA, and you can revoke SSH keys from your account if your development machine is ever stolen or missing. 0. https://github.community/t5/Support-Protips/Using-one-account-for-all-your-projects/ba-p/5509 https://github.community/t5/Support-Protips/Using-one-accoun...
    • tptacek 7y ago
      Github is, pretty clearly, wrong about this.
  • tialaramex 7y ago
    If that would be "crazy" then I don't really see why you're so enthusiastic about using the same key for these "different" accounts. I get how you can make it arguably safe, but it just seems like a needless risk exactly like a single shared account.
  • mbesto 7y ago
    Don't you find it a little crazy from a security perspective that you're using your machines for both personal and work purposes?
    • tptacek 7y ago
      We're not; "personal" was just easier to write in the moment than "single long term durable account associated with Latacora".
      • mbesto 7y ago
        Ok so what advantage does that give you? The idea of PKI is that your identification is tied to your machine. Why are you unnecessarily conflating authorization with authentication?