3 ms·
As I said recently in a talk I gave, 2FA as implemented by pypy or github is meaningless, when in fact all actions are performed via tokens that never expire, t
by LtWorf 3y ago
As I said recently in a talk I gave, 2FA as implemented by pypy or github is meaningless, when in fact all actions are performed via tokens that never expire, that are saved inside a .txt file on the disk.
- CapstanRoller 3y agoDoesn't GH explicitly warn against using non-expiring tokens?
- heyoni 3y agoPasswords have full scope of permission while session tokens can be limited.
- LtWorf 3y agoIn pypi to obtain a token that is limited in scope you must first generate an unlimited token. True story. In gh you can generate a limited one, but it's not really clear on what the permissions actually mean, so it's trial and error… which means most people will get tired and grant random stuff to have them working.
- heyoni 3y agoI didn’t know that about pypi but github has seemed ok to me. I’ve also implemented my own scoped authentication systems so even if they’re not perfect I know it can be done