5 ms·
Considering that the code in a GitHub organization or in a repo with collaborators is only as safe as the weakest link in the chain of users that have access to
by fphilipe 13y ago
Considering that the code in a GitHub organization or in a repo with collaborators is only as safe as the weakest link in the chain of users that have access to it, it would be nice if the admin of that org/repo could set a policy that all members need to have 2-factor authentication activated before they get full access to the codebase. Enforcing strong and unique passwords is hard, but enforcing 2-factor is easy and the bump in added security is high. At least I would sleep better knowing that, for an attacker to access the codebase, brute forcing would not be possible.
- csmuk 13y agoEnforcing unique and strong passwords is not hard. We do it.
- fphilipe 13y agoHow do you enforce a unique password? With unique I mean that the user has not used that password for any other website.
- nilved 13y agoGenerating it for them.
- oneeyedpigeon 13y agohow do you make it memorable enough so they don't just write it down? passphrases?
- mdpopescu 13y agoWhat's the problem with writing it down? I periodically generate a strong random new password, write it down and put it in my wallet with my credit cards, until I type it enough times that I learned it. Writing it down and leaving it exposed in a public place, like taped to your monitor - bad. Writing it down and treating it like any other important asset - not that bad.
- oneeyedpigeon 13y agoActually, that's very nearly the approach I'm taking myself, so fair point (just that IT professionals usually run screaming for the hills if you talk about writing a password down). However, it also sounds like you're using just one password for everything - that seems very unwise.
- mdpopescu 13y agoAh - that's the master password for LastPass. I should have clarified that.
- deleted 13y ago[deleted]
- joshguthrie 13y agoThis. A thousand times this. Passwords are HARD to remember but it's better to have it under hand than to ask for a new one every two days because we didn't have time to remember it (my school stored students password in clear text in their DB and gave them out printed on paper sheets. Four years later, I still have this sheet in my wallet, my three passwords never got compromised and I memorized each of them after less than two weeks of heavy usage). > IT professionals usually run screaming for the hills if you talk about writing a password down I can understand that. You and I keep our passwords in our wallets. Some employees keep them on post-its taped to their computer screen at work. If a password I keep in my wallet gets compromised because it's been stolen with the wallet, I have more pressing matters to deal with than "oh crap, a random guy who stole me my wallet in the subway may use it to access our repo and add bad code in my name". The point about "not that bad" is that security is an illusion: you can use a thousand passwords everywhere with different set of keys for github, server A and server B, change password every week and never write it down, plus a little bit of tin foil hat paranoia,... But in the end, a $5 wrench will make you spit out all the access keys needed by someone who REALLY wants an access.
- DoggettCK 13y agoI've kept a post-it under my keyboard for years with "How do you keep a security auditor busy?" written in a pigpen cipher.
- mtrimpe 13y agoUnique across all other services the user has accounts at? If you did that it would be both creepy and impressive. :)
- csmuk 13y agoWe try to make sure it is by enforcing password expiry, no password reuse and complex passwords. We also have a massive shitlist of passwords from various leaks.
- RobAley 13y agoBecause of which, your users probably write their password down on a post-it note stuck to their monitor...
- daigoba66 13y agoThat's a lot safer than using a weak password. I don't have a citation handy but security researchers often support writing down passwords to encourage using stronger and more frequently changed passwords.
- RobAley 13y agoThat depends, if it's on a system that's accessible internally only, then it's likely not safer.
- dalore 13y agoLet's start a global registry where everyone registers the password you use at every site. So we can cross reference and check that you (or anyone else) hasn't used that password elsewhere. OF course we will store the password in plain text.