4 ms·
Exactly. It simply should not be allowed to do this. Nor maintain Actions without mandatory 2FA. All it takes is one account to be compromised to infect thousa
by cedws 2y ago
Exactly.
It simply should not be allowed to do this. Nor maintain Actions without mandatory 2FA. All it takes is one account to be compromised to infect thousands of pipelines. Thousands of pipelines can be used to infect thousands of repos. Thousands of repos can be used to infect thousands of accounts... ad infinitum.
- guappa 2y ago2FA matters very little when you have never expiring tokens.
- dawnerd 2y agoAnd thanks to the likes of composer and similar devs end up making non expiring tokens to reduce annoyance. There needs to be a better system. Having to manually generate a token for tooling can be a drag.
- blueflow 2y ago2FA also matters little if the attacker has compromised your machine. They can use your 2FA-authenticated session.
- guappa 2y agoOnly once… but if they can get your forever token… that's not the same.
- GoblinSlayer 2y agoOnce is enough.