GitHub Prepares to Move Beyond Passwords

GitHub Passwords
Share It On:

13th May 2021, Kathmandu

Github, a platform that provides internet hosting for software development and distributed version control, uses Git over SSH as supporting security keys.

Kevin Jones, the Github security engineer, said that this is the next step to increasing security and usability. To secure git operations and to avoid misery when private keys accidentally get lost or pilfered or when malware tries to initiate requests without user approval which is why portable FIDO2 fobs are used for SSH authentication.

YubiKey, Thetis Fido U2F Security Key, and Google Titan Security Keys are easy to cart around between machines, connecting via USB, NFC, or Bluetooth. They provide an alternative to the one-time passwords provided by applications or sent via SMS so, SSH codes sent via text can be and have been intercepted.

The key keeps its secrets tucked away and out of reach; therefore, much of the data on a security key is protected from external access and modification. Those on-computer private keys are simply a reference to the physical security key, meaning they’re useless to anybody who doesn’t have the actual device in hand.

One of the factors in multi-factor authentication (MFA) is keys. Users should safeguard the devices just like any other credential. You can leave it plugged in if you’re the only one who can get at your security key. Neither malware nor accidental private-key exposure will cause any harm. Using SSH with a security key means none of the sensitive information ever leaves the physical security key device.

Existing Security Keys Can Still Be Used for Git

Users can create a public- and private key pair, but secret bits are generated and stored in the security key where public parts are stored on users’ machines like any other SSH public key.

An action that indicates “user presence” that is security key requires you to perform a gesture such as tapping to let it know you’re about to use the device to authenticate. Users can also utilize the same security key for both web and SSH authentication, given that they’re not limited to a single application and eliminates the use of 2FA when authenticating to Git.

Yet check all the authentication boxes: a strong password, enrolling in two-factor authentication, and setting up account recovery mechanisms.

(Almost) the Same SSH Keys You Already Love

Users are still able to password-protect their keys and require a security key. Previously an RSA or ed25519 key was used mostly, whereas now they have the option of using two additional key types: ecdsa-sk and ed25519-sk, where the “sk” means “security key.”

A series of steps in Github’s Documentation leads users to create and add a key that’s somewhat similar to how it’s been done before. Users can remove previously registered SSH keys and stick to the SSH keys created by the security keys as long as the only person pulling Git data keeps that security key good and safe.

Stick a Fork in Passwords: They’re Done

Password security has always been a weak spot for everyone because they always can’t seem to remember it or use it right. This new SSH security leads to a new password-less future.

Github declared that from august 13, the preceding two weeks would be used as a test period in this brave new world of no-passwords-please, where token-based authentication will be required for all authenticated API operations GitHub.com. As a result, passwords will no longer be supported for Git operations starting later this year.

As most Github users are technical, it is said that it won’t be much difficult for them to understand how the tokens and keys work, yet it may be tough as they may not want to use a more secure access method.


Share It On:

Recent Posts

Child Online Protection in Nepal: Insights From UNICEF and ChildSafeNet Dialogue

Child Online Protection in Nepal: Insights From UNICEF and ChildSafeNet

Share It On:21st December 2024, Kathmandu A high-level dialogue on child online protection organized by UNICEF, in partnership with ChildSafeNet,

Support Your NPL Team With Ncell’s Exclusive PRBTs

Support Your NPL Team With Ncell’s Exclusive PRBTs

Share It On:20th December 2024, Kathmandu As the finale of the Nepal Premier League (NPL), the ‘Festival of the Himalayas,’

Garima Bank Cash Dividend Proposal: 5% for Shareholders

Garima Bank Cash Dividend Proposal: 5% for Shareholders

Share It On: 20th December 2024, Kathmandu Garima Bikas Bank has announced its decision to offer a cash dividend to

Citizens Bank and SM Dental Partnership: Exclusive Discounts for Digital Payment Users

Citizens Bank and SM Dental Partnership: Exclusive Discounts for Digital

Share It On: 20th December 2024, kathmandu Citizens Bank International Limited has formed a strategic partnership with SM Dental and

Nabil Bank Toll-Free Number for Easy Banking Support: 24/7 Access to Assistance

Nabil Bank Toll-Free Number for Easy Banking Support: 24/7 Access

Share It On: 20th December 2024, kathmandu Nabil Bank Limited has rolled out a new initiative to improve customer support

Ncell Unlimited Data Saapati: 1-Day Internet for Prepaid Users with Low Balance

Ncell Unlimited Data Saapati: 1-Day Internet for Prepaid Users with

Share It On:20th December 2024, kathmandu  Ncell has started to provide Unlimited Data as Saapati, enabling customers to stay online