5 ms·
Whilst yes, GitHub Sudo Mode will certainly help if you leave your machine unattended or someone snipes just your session, but it won't help if someone gets you
by Smerity 13y ago
Whilst yes, GitHub Sudo Mode will certainly help if you leave your machine unattended or someone snipes just your session, but it won't help if someone gets your password. GitHub should have two-factor authentication by now.
We've already seen the Github SSL replaced by a self-signed certificate in China[1] and I'm sure other similar situations have occurred, so stealing the password via man-in-the-middle or a similar attack is feasible. GitHub uses HSTS[2] but something like SSLStrip[3] only needs to work once for your account and repositories to be compromised.
GitHub, like it or not, is the key to a lot of valuable resources. From private repositories for start-ups or large companies to public open source repositories used by millions, they're all potentially vulnerable.
I should clarify that I do love GitHub, they've improved collaboration in the open source scene substantially, but when something like homakov's GitHub exploit occurs, you realise how important GitHub's security is.
[1]: https://news.ycombinator.com/item?id=5124784 https://news.ycombinator.com/item?id=5124784
[2]: http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
[3]: http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/
- fintler 13y agoI already have 4 different fobs on my keychain (not counting my YubiKey for LastPass). I'm not quite sure what I'll do when every website has one and I'll need 20 of them. It also doesn't help that they're all unlabeled. Edit: I just realized I actually have 6 fobs, but I only keep 4 on my keychain.
- calebegg 13y agoLots of sites use RFC 6238 -- Github probably would too. Then you can just use Google Authenticator (or similar) to manage them.
- zokier 13y agoI suspect that smartphones will be the future of authentication, for better or worse. It would be neat if you could tap your phone at your computer to authenticate with actually secure crypto handshake over NFC. Most likely we'll be stuck on google-authenticator -like stuff, which feels bit of a kludge in comparison.
- fintler 13y agoI work in an environment where radios and cameras of any kind aren't allowed (not an unreasonable policy for where I work). So, I'll be stuck with the fobs for a bit. The trend of everything moving towards smartphones limits my options. However, YubiKey OTP works well, so it's not a big issue -- I just hope more competition pops up. Also, personally I trust fobs more than my smartphone. My smartphone is a device which is always connected to a network. I don't want to be one remote exploit and a password leak away from having every credential I control compromised.
- chatmasta 13y agoOf all the sites to have two factor authentication, GitHub is probably the most important, maybe even more so than email clients. If your email is compromised, you are the only one who suffers directly. But if a large repo gets compromised, every single user of that repo could be compromised. I imagine there is some widely distributed auto updating desktop software that depends on GitHub repos. Imagine if one of those repos was suddenly changed to include a key logger for example. A lot more than one person would suffer.
- abraham 13y agoIf you would like to see GitHub add two-factor auth, drop them a note saying as much. https://help.github.com/contact https://help.github.com/contact
- bjeanes 13y agoI guarantee they are working on it. I don't use the word guarantee loosely, either.