9 ms·
I imagine it might be easier to just compromise a weakly protected account than to actual put in a 2 years long effort with real contributions. If we mandated M
by hangonhn 3y ago
I imagine it might be easier to just compromise a weakly protected account than to actual put in a 2 years long effort with real contributions. If we mandated MFA for all contributors who contribute to these really important projects then we can know with greater certainty if it was really a long con vs. a recently compromised account.
- __s 3y agoThis seems like a great way to invest in supporting open source projects in meantime if these projects are being used by these actors. Just have to maintain an internal fork without the backdoors Maybe someone can disrupt the open source funding problem by brokering exploit bounties /s
- the8472 3y agogithub already mandates MFA for members of important projects
- rvense 3y agoDoesn't it mandate it for everyone? I don't use it anymore and haven't logged in since forever, but I think I got a series of e-mails that it was being made mandatory.
- ryukoposting 3y agoIt will soon. I think I have to sort it out before April 4. My passwords are already >20 random characters, so I wasn't going to do it until they told me to.
- pabs3 3y agoIf you are using pass to store those, check out pass-otp and browserpass, since GitHub still allows TOTP for MFA. pass-otp is based on oathtool, so you can do it more manually too if you don't use pass.
- ryukoposting 3y agoMy solution is far shittier than any of those.
- loeg 3y agoIt mandates it for everyone. I'm locked out of Github because fuck that.
- illusive4080 3y agoWhy opposed to MFA? Source code is one of the most important assets in our realm.
- userbinator 3y agoFreedom is far more important.
- illusive4080 3y agoBut you can use any totp authenticator. The protocol is free and open.
- userbinator 3y agoIt's more to make the point that "no means no." An act of protest. (I have written a TOTP implementation myself. I do not have a GH account, and likely never will.)
- Dylan16807 3y agoIt's ridiculous to say "no means no" about not wanting to use a password to get an account, right? What makes TOTP different from a password in terms of use or refusal?
- ndriscoll 3y agoBrowsers don't save the TOTP seed and auto fill it for you for one, making it much less user friendly than a password in practice. The main problem I have with MFA is that it gets used too frequently for things that don't need that much protection, which from my perspective is basically anything other than making a transfer or trade in my bank/brokerage. Just user-hostile requiring of manual action, including finding my phone that I don't always keep on me. It's also often used as a way to justify collecting a phone number, which I wouldn't even have if not for MFA.
- rst 3y agoWhich helps with some kinds of threats, but not all. It keeps someone from pretending to be the maintainer -- but if an actual maintainer is compromised, coerced, or just bad from the start and biding their time, they can still do whatever they want with full access rights.
- the8472 3y agoYou probably should have replied that to the GP, not me. I only clarified that what they were suggesting already is the case.
- guinea-unicorn 3y agoI find it funny how MFA is treated as if it would make account takeover suddenly impossible. It's just a bit more work, isn't it? And a big loss in convenience. I'd much rather see passwords entirely replaced by key-based authentication. That would improve security. Adding 2FA to my password is just patching a fundamentally broken system.
- hangonhn 3y agoyeah someone replied to one of my comments about adding MFA that an attacker can get around all that simply by buying the account from the author. I was way too narrowly focused on the technical aspects and was completely blind to other avenues like social engineering, etc. All very fair points.
- Jakesben10 3y ago[flagged]
- ryukoposting 3y agoCustomer service at one of my banks has an official policy of sending me a verification code via email that I then read to them over the phone, and that's not even close to the most "wrong" 2FA implementation I've ever seen. Somehow that institution knows what a YubiKey is, but several major banks don't.
- Liquix 3y agoFinancial institutions are very slow to adopt new tech. Especially tech that will inevitably cost $$$ in support hours when users start locking themselves out of their accounts. There is little to no advantage to being the first bank to implement YubiKey 2FA. To a risk-averse org, the non-zero chance of a botched rollout or displeased customers outweighs any potential benefit.
- monksy 3y agoThey're pretty terrible when they do. For the longest time the max password size was 8 characters and the csr knew what your password was. Heck I've had Chase security tell me they'd call me back.. dude that's exactly how people get compromised.
- LtWorf 3y agoAs I said recently in a talk I gave, 2FA as implemented by pypy or github is meaningless, when in fact all actions are performed via tokens that never expire, that are saved inside a .txt file on the disk.
- CapstanRoller 3y agoDoesn't GH explicitly warn against using non-expiring tokens?
- heyoni 3y agoPasswords have full scope of permission while session tokens can be limited.
- LtWorf 3y agoIn pypi to obtain a token that is limited in scope you must first generate an unlimited token. True story. In gh you can generate a limited one, but it's not really clear on what the permissions actually mean, so it's trial and error… which means most people will get tired and grant random stuff to have them working.
- heyoni 3y agoI didn’t know that about pypi but github has seemed ok to me. I’ve also implemented my own scoped authentication systems so even if they’re not perfect I know it can be done
- tw04 3y agoFor some random server, sure. For a state sponsored attack? Having an embedded exploit you can use when convenient, or better yet an unknown exploit affecting every linux-based system connected to the internet that you can use when war breaks out - that's invaluable.
- eru 3y agoYes, but even states have only finite resources, so even for them compromising an account would be cheaper. (But you are right that a sleeper would be affordable for them.)
- treflop 3y agoHaving one or two people on payroll to occasionally add commits to a project isn't exactly that expensive if it pays off. There are ~29,000,000 US government employees (federal, state and local). Other countries like China and India have tens of millions of government employees.
- microtonal 3y agoAnd they might as well be working on compromising other projects using different handles.
- eru 3y agoNot all government employees are equally capable.
- EvmRoot 3y agoEven if they contract it out, at $350/hr (which is not a price that would raise any flags), that is less that $750k. Even with a fancy office, couple of laptops and 5' monitors, this is less than a day at the bombing range or a few minutes keeping an aircraft carrier operational. Even a team of 10 people working on this - the code and social aspect - would be a drop in the bucket for any nation-state.
- 3y ago
- EasyMark 3y agothey might not have been playing the long con. maybe approached by actors willing to pay them a lot of money to try and slip in a back door. I'm sure a deep dive into code contributions would clear that up for anyone familiar with the code base and some free time.
- deleted 3y ago[deleted]
- bobba27 3y agoThey did fuck up quite a bit though. They injected their payload before they checked if oss-fuzz or valgrind or ... would notice something wrong. That is sloppy and should have been anticipated and addressed BEFORE activating the code. Anyway. This team got caught. What are the odds that this state-actor that did this, that this was the only project / team / library that they decided to attack?
- account42 3y agoUsing sockpuppets to pressure the original maintainer into granting commit access in the first place backs the long con theory.
- gamer191 3y agoThis PR from July 8 2023 is suspicious, so it was very likely a long con: https://github.com/google/oss-fuzz/pull/10667 https://github.com/google/oss-fuzz/pull/10667
- beginner_ 3y agoNot MFA but git commit signing. I don't get why such core low-level projects don't mandate it. MFA doesn0t help if a github access token is stolen and I bet most of use such a token for pushing from an IDE. Even if an access token to github is stolen, the sudden lack of signed commit should raise red flags. github should allow projects to force commit signing (if not already possible). Then the access token plus the singing key would need to be stolen. But of course all that doesn't help in the here more likley scenario of a long con by a state-sponsored hacker or in case of duress (which in certain countries seems pretty likley to happen)
- account42 3y agoGit signing would not have helped here. In fact, the tags and release archives were signed.
- bobba27 3y agoThis is a state sponsored event. Pretty poorly executed though as they were tweaking and modifying things in their and other tools after the fact though. As a state sponsored project. What makes you think this is their only project and that this is a big setback? I am paranoid myself to think yesterdays meeting went like : "team #25 has failed/been found out. Reallocate resources to the other 49 teams."