3 ms·
Except it's not actually 2FA if all it takes is an ssh key to push. That's only one factor. Doesn't address the threat model of compromised developer machine.
by tedunangst 5y ago
Except it's not actually 2FA if all it takes is an ssh key to push. That's only one factor. Doesn't address the threat model of compromised developer machine.
- svnpenn 5y agoPlease, don't give them any more "good" ideas.
- newjersey 5y agoYes, if I need to fish out my phone and put in a code every time I need to git fetch a private repo, I will do everything I can to convince anyone who will listen away from GitHub
- aseipp 5y agoBut it's significantly easier, like way way easier, to phish someone versus compromise a filesystem and extract SSH keys. And you can just add keys afterwords if you phish them, so why wouldn't you go the easy route? That's why phishing is still such a massive problem: because it works.
- potatoz2 5y agoIf your SSH key is encrypted, it’s 2FA. Either way, it’s not phishable (unlike passwords) so it’s way safer.
- deadbunny 5y agoDerive you SSH key from a GPG key stored on a YubiKey[1] and even if you comprise the machine you don't get the keys. 1. https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide