3 ms·
> Passwords are 100% the weakest link in our beep boop chain of trust, of course - we know this. But maybe they should just be rethought from the ground up inst
by scrollaway 5y ago
> Passwords are 100% the weakest link in our beep boop chain of trust, of course - we know this. But maybe they should just be rethought from the ground up instead of randomly affecting your users all the time with security nonsense.
Github is not in a position to "rethink passwords from the ground up". They are however in a position where it's their responsibility to ensure the security of what they host.
These changes are good. That you're calling them "absurd" and "security nonsense" speaks volumes, to be honest.
And if one of your keys is about to expire (I'm guessing a GPG key since SSH keys traditionally have no expiration), that'd be because you put an expiration date on it. One you chose…
- arthurcolle 5y agoYou're probably right, I was speaking about authentication on the whole from an industry perspective. I'm allowed to be annoyed with something that disrupts me from Innovating™ so I used my post as an outlet to do just that. P.S. no the email that came is was related to a personal access token for my own special projects account. Maybe they defaulted to some expiration period, don't care enough to go out of my way to find out right now.
- jimmaswell 5y agoPassword in your head: boo, evil, bad security, speaks volumes if you like them. SSH key stored on multiple devices which amounts to a saved password: wow, so secure, much better. I still don't get it.