3 ms·

Since this hasn't been a large scale security problem at all, it is probably a business move and an attempt to increase accountability. I host elsewhere already

Since this hasn't been a large scale security problem at all, it is probably a business move and an attempt to increase accountability. I host elsewhere already, but this is a bad move that cannot be explained by security arguments. They might want have any 2FA solution to hold people responsible. Youtube-dl ring a bell? Even if the authors are known, this grants Microsoft new levers against unwanted code. Get another source host asap. You either need a phone number or a smartphone app, which decreases overall security and compromises your privacy.

Arnt 6y ago
AIUI it has been a large scale problem, just not at Github. 1. If you built or rented a botnet using people's windows boxes and read the configuration files of the email clients on those windows boxes, you'd find passwords for services like gmail. Google put a dent in that scheme using oauth and app passwords. 2. I know that some companies have been scanning their own computers for high-value stored secrets and asking their vendors to stop supporting such things. Such requests from GHE customers would be a real problem for Github, because of how much GHE customers pay.