14 ms·
> While our log analysis, conducted from March 5 through March 8, confirmed that this was a rare issue, it could not rule out the possibility that a session had
by polote 6y ago
> While our log analysis, conducted from March 5 through March 8, confirmed that this was a rare issue, it could not rule out the possibility that a session had been incorrectly returned but then never used. This was not a risk we were willing to take, given the potential impact of even one of these incorrectly returned sessions being used.
It is funny how they make it seem like they are super cautious. When in fact they had no other choice than do it when you rephrase the problem as " there were maybe some people who got the admin right of the github account of some of our customers"
- lathiat 6y agoYou say that, but resetting all the sessions is very publicly visible and plenty of smaller companies would paper over such things. Honestly I don't really expect any less from Github or Microsoft scale but don't kid yourself into thinking that kind of things goes un-noticed, un-investigated or un-actioned elsewhere.
- ComputerGuru 6y agoTo the contrary, I find my session tokens get reset left and right by websites that don’t even care about how much of an inconvenience it is for the customers.
- ncann 6y agoYeah, I don't visit GitHub that often, maybe once a week but it logs me out every damn time. I wonder if it's because I have 2FA setup or something.
- yunohn 6y agoI use a food delivery service (website only, no app) that doesn’t even remember the chosen language setting, and of course, never keeps you logged in past 24hrs. So effectively, need to login every time I make an order...
- jspash 6y agoThis is my biggest pet peeve about delivery service websites. What are the chances that I've moved house since I last ordered a pizza two days ago? Why do you incessantly ask for my postcode? When I log in, assume I'm the same person at the same address. If I have moved and accidentally order to the old house...well that's on me and I'd have to be pretty stupid (or hungry) to do such as thing.
- noir_lord 6y agoI mean they could do both. Default to last postcode but display it on the confirmation screen "Sending your Pizza to LE13 XYZ" - amazon does it right (as you'd mostly expect)
- alpaca128 6y agoThat happens to me even on YouTube. Every couple of months I have to fix the language setting and switch back to dark theme. What can't be fixed are Google's weird attempts at auto-translating video titles from other languages, making me click on videos that I simply cannot understand. Don't do that, Google. Do full title, thumbnail and video translation with 90% accuracy or just...don't. Half-assed tech is easy but not helpful for anyone.
- nexuist 6y agoIs it really that hard to log in again? Using a password manager it's basically two clicks to autofill the right account and hit the submit button. Login limits are a good thing. It means that the chances of someone taking over your account and using it long term is minimized.
- Ennea 6y agoIt is not. But a ton of sites seem to be inconsistent about it, or it feels that way at least. Some sites I frequent don't log me out for months at a time, and then suddenly they do. And then they do it again a few weeks later. Followed by multiple months of not doing it once more.
- imtringued 6y agoBecause Discord doesn't let you change avatars I have created three different Discord accounts. I get logged out of all three all the time. It's a massive pain.
- chrisandchris 6y agoPersonal opinion: Clear cookies every time you stop the browser process, which basically is at least once a day. Logs you out of all services. It‘s a nightmare as a user, but I don‘t want to stick those tracking to cookies around longer than a single day.
- SamuelAdams 6y agoFirefox can do this automatically. Options > Privacy & Security > check the box "Delete cookies and site data when Firefox is closed". Anything you intentionally want to retain can be added to the exceptions list.
- fsckboy 6y ago"Delete cookies and site data when Firefox is closed" has always bothered me; it should be "Delete cookies and site data when Firefox is opened", because abnormal termination is not "closing", and you'd still want the cookies deleted when you start up again.
- motiejus 6y agoThat way I'd lose the GDPR opt-outs from the number of sites I've gone through the process. Perhaps I should just accept the consent and remove cookies regularly, instead of being careful with the consent forms... Hmm, good idea.
- jjav 6y agoYes, for sure. I use cookie autodelete to remove all cookies as soon as the tab is closed, so nothing lingers.
- XCSme 6y agoIf your concern is tracking, clearing the cookies doesn't help much. Next day you will login on the same services and websites that you logged before, and if they share data with 3rd parties they will keep sharing it, with or without cookies.
- TriNetra 6y agoObviously if they are logging all actions of all users, and there's some decent retention period, they can find out how many people got unintended access and what all they did with it. Recently, I got an advice from a C-level executive to include such analytics in ASPSecurityKit [0], because that's what companies are looking for these days. This GH incident makes me consider his suggestion more seriously. 0: https://ASPSecurityKit.net https://ASPSecurityKit.net
- abgr-y 6y agoThis points to the last A in AAA of security which stands for Authentication, Authorization & Accounting, AAA moniker is commonly used in reference to either RADIUS or Diameter (network protocols), the concept is widely used for software application security as well. So Accounting implies What resources were accessed, at what time, by whom, and what commands were issued?