GitHub Supports Web Authentication (WebAuthn) for Security Keys

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by u801e on Wednesday August 21, 2019 @08:09PM (#20763324)

I wonder if Github has ever considered allowing a 2FA via the use of the private ssh key that's used for running git push or git fetch/pull?

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by tialaramex on Thursday August 22, 2019 @04:09AM (#20765768)

Figuring out what sets of unrelated operations it's safe to do with the same private key is a problem. Definitely don't do this without a cryptographer examining all the operations done and telling you it's safe. Generally if asked they'll tell you to just make a new key instead because that's definitely fine.

Example: If an archaic backup MX mail server with private RSA key P is allowing SSLv3 "for backwards compatibility" then bad guys can use that to impersonate an otherwise unrelated TLS 1.3 web server that shares private RSA key P.

[ Parent | on HN ]