8 ms·
> You can say your email is Linus Torvalds’, and GitHub will not question it (and even link to his GitHub profile in the commit history!) That's the other way
by Denvercoder9 6y ago
> You can say your email is Linus Torvalds’, and GitHub will not question it (and even link to his GitHub profile in the commit history!)
That's the other way around though -- claiming the victims GitHub profile made a commit controlled by the attacker, instead of claiming the attackers GitHub profile made a commit controlled by the victim.
- Sebb767 6y agoNo, you could claim the commits made by the victim this way. The steps would be: 1. Look for a contributor without GitHub account (i.e. xy@gmail.com ) 2. Add xy@gmail.com to your GitHub account/create one with that address [0] 2.1 The commits made by the victim will now link to your account on GitHub 3. Send a mail to Nikita with your faked GitHub-profile None of this will survive a thorough check, but under pressure this will easily pass a surface-level check. [0] I think you need to confirm your primary E-Mail, but not secondary ones. Alternatively, you could look for commits made from an now deleted mail account.
- jwilk 6y agoYup, AFAICS GitHub associates secondary addresses with your account without verification. Although the victim would be notified that their address was added to a rogue account, the notification mail says: "If this wasn’t you, please ignore this email." Ugh.