3 ms·

I hate github like every other guy, but this has nothing to do with the announcement. They're disallowing ssh password auth that's all, non-authenticated operat

I hate github like every other guy, but this has nothing to do with the announcement. They're disallowing ssh password auth that's all, non-authenticated operations are fine and ssh pubkey auth is fine. Seems legit to me.

dathinab 6y ago
> Seems legit to me. Fully so. I was super surprised when I happened to try to push on a temp. system which wasn't properly setup (no ssh key) and it asked me for my password. I'm also always surprised if e.g. password based SMTP for mail is still allowed (it most times is, but is a security problem, through not a big one). I just which the way to get the token (in general no github specific) would be better.
- tialaramex 6y ago
  Authentication for email and other passive services is a bit trickier. For example suppose your mail server falls over, then is restarted. Does the mail client on your phone go "Hey, I need to re-authenticate to this server?" and meanwhile you don't receive any email? That's a not-great user experience. For SMTP this is a bit less fraught because at least the user presumably just did something to cause sending, so we can ask them to authenticate at that point. But that still can be a bit trickier than you'd like. There's also a much nastier backward compatibility story for email than for a relatively recent thing like GitHub. There absolutely will be a user with an Amiga 1200 using email on a big email service. Do you cut their service off? Maybe you have to, if that's the only way to secure service for other users. But it's a real last resort.
  - dathinab 6y ago
    > For example suppose your mail server falls over, If token based authentication is affected by this your mail server is doing things very very wrong. ---- I'm well aware about all the problems involved when it comes to mail/smtp auth by now. Still username+password auth done by any client for anything but the initial sign-up is a latent security vulnerability even if it's currently tricky to fix. -------- > There absolutely will be a user with an Amiga 1200 using email on a big email service. Do you cut their service off? Yes, if I would be a mail company I most likely would not have any reason to support them tbh. Probably a better example would be outdated outlook versions ;=)

dathinab 6y ago

> Seems legit to me. Fully so. I was super surprised when I happened to try to push on a temp. system which wasn't properly setup (no ssh key) and it asked me for my password. I'm also always surprised if e.g. password based SMTP for mail is still allowed (it most times is, but is a security problem, through not a big one). I just which the way to get the token (in general no github specific) would be better.

tialaramex 6y ago
Authentication for email and other passive services is a bit trickier. For example suppose your mail server falls over, then is restarted. Does the mail client on your phone go "Hey, I need to re-authenticate to this server?" and meanwhile you don't receive any email? That's a not-great user experience. For SMTP this is a bit less fraught because at least the user presumably just did something to cause sending, so we can ask them to authenticate at that point. But that still can be a bit trickier than you'd like. There's also a much nastier backward compatibility story for email than for a relatively recent thing like GitHub. There absolutely will be a user with an Amiga 1200 using email on a big email service. Do you cut their service off? Maybe you have to, if that's the only way to secure service for other users. But it's a real last resort.
- dathinab 6y ago
  > For example suppose your mail server falls over, If token based authentication is affected by this your mail server is doing things very very wrong. ---- I'm well aware about all the problems involved when it comes to mail/smtp auth by now. Still username+password auth done by any client for anything but the initial sign-up is a latent security vulnerability even if it's currently tricky to fix. -------- > There absolutely will be a user with an Amiga 1200 using email on a big email service. Do you cut their service off? Yes, if I would be a mail company I most likely would not have any reason to support them tbh. Probably a better example would be outdated outlook versions ;=)