11–20 of 353 posts
I have a noob question: what's the right way to use these tokens without password managers? I believe Github recommended assigning it as an environment variable in docs related to this deprecation, but isn't a (managed) server free to log the output of `echo $token`?
https://docs.github.com/en/developers/apps/getting-started-w...
I have a noob question: what's the right way to use these tokens without password managers? I believe Github recommended assigning it as an environment variable in docs related to this deprecation, but isn't a (managed) server free to log the output of `echo $token`?
For a semi-trusted machine (e.g., you want to "git push" to work-related OSS from your work desktop, but you don't want your work HR/IT departments to have full access to your GitHub account if they decide they want it), make a new SSH key and configure it as a read/write deploy key for that one repo. This workflow is primarily intended for automation, but it's reasonable for this sort of interactive use as well.
https://docs.github.com/en/developers/overview/managing-depl...
I wonder how many old, forgotten systems there are out there that pull from Github with a password. Brownouts are a smart way to try and weed those out, but there are going to be residual requests. I wonder how many.
Embrace. Extend. Extinguish
I have a noob question: what's the right way to use these tokens without password managers? I believe Github recommended assigning it as an environment variable in docs related to this deprecation, but isn't a (managed) server free to log the output of `echo $token`?
But if you aren't confident of it, then at least that token only has access to a repository, and can't be exfiltrated to let somebody log in and really mess with your user account or your organization.
(All that said: I'd recommend a single-use, minimally privileged SSH key over an access token, just because that workflow's what you should be using on a desktop too.)
tldr Git SSH protocol will still support authentication via username:password but in this case, the "password" can no longer be your Github Account password, but it can be a Personal Access Token. So no need to panic if you've been using a build system or other tool that authenticates with username:token instead of a SSH key.
Earlier quoted context omitted.
They do it to prevent passwords, which allow access to privileged things like account settings, from being stored (and thus subject to being accidentally leaked). It doesn't matter how long your password is if your password is in a text file with bad chmod permissions to people who shouldn't have it. An access token, at least, limits the blast radius.
Ah get it. They don't want the password to login on github to be the same as the one you store on a text file. Makes sense. But it is still Baby-sitting
Many, many GitHub users are not professional software developers, and many more than that are not security-minded users at all. Small incremental improvements like this are a kind of defense in depth, and it is valuable.
Earlier quoted context omitted.
They do it to prevent passwords, which allow access to privileged things like account settings, from being stored (and thus subject to being accidentally leaked). It doesn't matter how long your password is if your password is in a text file with bad chmod permissions to people who shouldn't have it. An access token, at least, limits the blast radius.
Ah get it. They don't want the password to login on github to be the same as the one you store on a text file. Makes sense. But it is still Baby-sitting
Earlier quoted context omitted.
They do it to prevent passwords, which allow access to privileged things like account settings, from being stored (and thus subject to being accidentally leaked). It doesn't matter how long your password is if your password is in a text file with bad chmod permissions to people who shouldn't have it. An access token, at least, limits the blast radius.
Ah get it. They don't want the password to login on github to be the same as the one you store on a text file. Makes sense. But it is still Baby-sitting
Do you consider password length requirements baby-sitting?