2 ms·
All the attackers need to do is steal an SSH key and they'd be able to clone everything, no?
by stavros 5mo ago
All the attackers need to do is steal an SSH key and they'd be able to clone everything, no?
- LtWorf 5mo agoDepends how it's set up. Many companies add an IP address check so if you don't come via their VPN (or are not in the office) the connection will be rejected before any auth is asked. So you'd need to authenticate for the VPN, which often has 2nd factor. But I have no idea of how they are set up.
- fernie 5mo agoNah GitHub/MS doesn't allow SSH keys for their internal stuff. You have to use git-credential-manager, which enforces MFA