4 ms·

This is stupid, they only had to request passwords longer than 15 characters and that would have an even better effect. As web access will be also safer. They

by polote 5y ago

This is stupid, they only had to request passwords longer than 15 characters and that would have an even better effect. As web access will be also safer. They do it to prevent password reuse, but still allow passwords on the web. I don't get it

X6S1x6Okd1st 5y ago
You have a much more flexible interface with the user on the web than via git push.
eropple 5y ago
They do it to prevent passwords, which allow access to privileged things like account settings, from being stored (and thus subject to being accidentally leaked). It doesn't matter how long your password is if your password is in a text file with bad chmod permissions to people who shouldn't have it. An access token, at least, limits the blast radius.
- polote 5y ago
  Ah get it. They don't want the password to login on github to be the same as the one you store on a text file. Makes sense. But it is still Baby-sitting
  - nerdponx 5y ago
    If this is babysitting, I never want to grow up.
  - eropple 5y ago
    What you describe as "baby-sitting", I would call "encouraging users to fall into the pit of success." Many, many GitHub users are not professional software developers, and many more than that are not security-minded users at all. Small incremental improvements like this are a kind of defense in depth, and it is valuable.
  - tclancy 5y ago
    And we have fifty years of software development history to prove we need this kind of babysitting. It’s a pain one time and then you realize it wasn’t hard to do and start doing a better practice out of habit.
  - kdmccormick 5y ago
    Eh, I think everyone stands to benefit when a service increases their security standards in a reasonable way. Fewer account recovery support requests for them, fewer footguns for inexperienced users of theirs. Do you consider password length requirements baby-sitting?
- lanstin 5y ago
  I doubt this "saved passwords" is the issue, but people choosing guessable passwords. Especially with the bit-coin attacks on the Github CI sandboxes, thee attackers don't care about the repo that much but they want access to the X% of github accounts that use a top 100 or top 1000 password, so they can get in and start mining.

by polote 5y ago

X6S1x6Okd1st 5y ago

You have a much more flexible interface with the user on the web than via git push.

eropple 5y ago

They do it to prevent passwords, which allow access to privileged things like account settings, from being stored (and thus subject to being accidentally leaked). It doesn't matter how long your password is if your password is in a text file with bad chmod permissions to people who shouldn't have it. An access token, at least, limits the blast radius.

polote 5y ago
Ah get it. They don't want the password to login on github to be the same as the one you store on a text file. Makes sense. But it is still Baby-sitting
- nerdponx 5y ago
  If this is babysitting, I never want to grow up.
- eropple 5y ago
  What you describe as "baby-sitting", I would call "encouraging users to fall into the pit of success." Many, many GitHub users are not professional software developers, and many more than that are not security-minded users at all. Small incremental improvements like this are a kind of defense in depth, and it is valuable.
- tclancy 5y ago
  And we have fifty years of software development history to prove we need this kind of babysitting. It’s a pain one time and then you realize it wasn’t hard to do and start doing a better practice out of habit.
- kdmccormick 5y ago
  Eh, I think everyone stands to benefit when a service increases their security standards in a reasonable way. Fewer account recovery support requests for them, fewer footguns for inexperienced users of theirs. Do you consider password length requirements baby-sitting?
lanstin 5y ago
I doubt this "saved passwords" is the issue, but people choosing guessable passwords. Especially with the bit-coin attacks on the Github CI sandboxes, thee attackers don't care about the repo that much but they want access to the X% of github accounts that use a top 100 or top 1000 password, so they can get in and start mining.