2 ms·
But he mentioned 2FA?
by kikoreis 7y ago
But he mentioned 2FA?
- tambourine_man 7y agoAh yes, I see.
- capableweb 7y agoAdd the 2FA to your password manager! At least 1Password supports this. Although, you might not want to do this, depending on your threat model. Take care if you do (now both password + 2FA can be obtained by having your password manager compromised, but at least your protected if only your password leaks from some dump)
- sowbug 7y agoI don't use OTP 2FA if U2F is available. Adding a physical token to a password manager is not an option. Part of the problem is that GitHub is both a source code repository frontend (calling for tighter security) and a social network (calling for minimal security). So the cookie expiration policy makes sense for the former case but not the latter. A compromise might be letting the user mark a specific browser instance as trusted, so that the site can either set a longer expiration or else not ask for the second factor from that instance. Anyway, was hoping someone had figured out which cookie held GitHub's token and knew a browser extension that could extend its lifetime. Not really looking to learn about password managers, which I already use.