3 ms·
No, I'm worried that if someone has temporary access to a machine that has one of these long-lived tokens, they may continue to have access to anything that tha
by mjg59 5y ago
No, I'm worried that if someone has temporary access to a machine that has one of these long-lived tokens, they may continue to have access to anything that that long-lived token grants access to.
- xnorswap 5y agoBut then there's no third party in that scenario, that's down to whoever was issuing those tokens and is part of securing their service.
- mjg59 5y agoI control my laptops. I control the policy for my identity provider. The service that hosts my source code is a third party, and defines their own policy which may not match mine.