GitHub Has a Permission Problem
games.greggman.com
GitHub Has a Permission Problem
1–10 of 130 posts
Re: GitHub Has a Permission Problem
#2Since the author doesn't link to it, here's where you can manage your Authorized OAuth apps (warning, password prompt):
Re: GitHub Has a Permission Problem
#3Perhaps if the blog was more straight to the point and with less adjectives, it would attract more attention.
The TL"TL;DR";DR is: "Thousands of developers are giving 3rd parties write access to their github repos (...) The tokens given to 3rd parties are just like passwords"
Re: GitHub Has a Permission Problem
#4Since the author doesn't link to it, here's where you can manage your Authorized OAuth apps (warning, password prompt): https://github.com/settings/applications
That page does not even show what permissions/scopes the Authorized OAuth apps have access to! (Or am I missing something?)
Re: GitHub Has a Permission Problem
#5Since the author doesn't link to it, here's where you can manage your Authorized OAuth apps (warning, password prompt): https://github.com/settings/applications
That page does not even show what permissions/scopes the Authorized OAuth apps have access to! (Or am I missing something?)
You're missing something. You can click the app name for a details+actions page for that app-grant.
Re: GitHub Has a Permission Problem
#6> Reading public info should not even be listed! It's already obvious that all your public info can be read by the app. That's the definition of public! There's no reason to tell me it might read it. It doesn't need permission to do so.
This is the permission you grant apps using GitHub for SSO, that allows GitHub to know what account you're logged in as. The information itself is public (anyone could scrape it from your public GitHub profile); but the fact that you are logged into that account is not public.
If any website could ask GitHub "is the current user logged into GitHub right now, and if so, as what account", without the user's consent, then that'd be considered a CSRF fingerprinting/permacookie vulnerability in GitHub.
Re: GitHub Has a Permission Problem
#7BTW if anyone is wondering whether that advertisement board regarding password security is real and where it is -- it is real and it is in Harajuku here:
https://goo.gl/maps/Nbt1kNe4gZ8oyH1F8
It has been there for something like 10 years as far as I can tell and there are more than one (go up the hill and you'll see the others). It's pretty amazing that someone has taken what I would consider prime advertising space for privacy ads in the world's biggest city for ~10 years.
It's a meme (and a bit annoying when it's the only angle anyone takes on Japan), but Japan is indeed weird.
Re: GitHub Has a Permission Problem
#8Earlier quoted context omitted.
That page does not even show what permissions/scopes the Authorized OAuth apps have access to! (Or am I missing something?)
You're missing something. You can click the app name for a details+actions page for that app-grant.
There it is. I looked under the three dots, and didn't find it. I think I assumed that clicking the app name would take me to the app.
Re: GitHub Has a Permission Problem
#9I was hoping this was about gists being publicly accessible even when they are private...
Re: GitHub Has a Permission Problem
#10BTW if anyone is wondering whether that advertisement board regarding password security is real and where it is -- it is real and it is in Harajuku here: https://goo.gl/maps/Nbt1kNe4gZ8oyH1F8 It has been there for something like 10 years as far as I can tell and there are more than one (go up the hill and you'll see the others). It's pretty amazing that someone has taken what I would consider prime advertising space…
[deleted]