News for hackers. Stuff that matters.

A comment on GitHub Supports Web Authentication (WebAuthn) for Security Keys.

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by tptacek on Wednesday August 21, 2019 @08:48PM (#20763569)
In a somewhat related vein: it would be really fantastic if Github allowed the same SSH key (in my case: a Yubikey-resident SSH key) on multiple accounts; we use separate accounts for different clients, and Github's refusal to allow an SSH key to be used on multiple accounts means I can't use Yubikey SSH keys for those.

I get that this is a niche-y concern. :)

[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by sowbug on Wednesday August 21, 2019 @10:56PM (#20764238)
Back in 2011 I posted a similar question to Quora. I've since deleted my Quora account, but here's the email notification I got about an answer:

===

New answer to "Why can't I add my public SSH key to more than one account on GitHub?"

Andrew Naoum: Because when you push via SSH to "[email protected]", it needs to uniquely identify who you are given the SSH public-key.

If you had the same key associated with multiple accounts, it wouldn't know which user to login as.

===

Perhaps if GitHub changed the SSH user to be something like [email protected], then SSH could authenticate you with a single key but preserve the other information needed to b narrow down to a project or organization.

[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by chrismorgan on Wednesday August 21, 2019 @09:07PM (#20763695)
That would require the ability to specify the username somehow, would it not, e.g. using [email protected]:… and [email protected]:… instead of [email protected]:…?
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by CameronNemo on Wednesday August 21, 2019 @10:31PM (#20764091)
Yeah something tells me this is a deep change related to how they manage identity. GitLab has the same issue.
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by DangitBobby on Thursday August 22, 2019 @01:42AM (#20764999)
Bitbucket allows you to use your SSH key on as many projects as you like, IIRC. I actually really like Bitbucket as a platform, I wish more people would use it.
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by andrewshadura on Thursday August 22, 2019 @07:03AM (#20766684)
They were a great platform, but they aren't any longer.
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by DangitBobby on Thursday August 22, 2019 @09:08PM (#20773794)
Go on...
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by est31 on Wednesday August 21, 2019 @10:40PM (#20764148)
I guess they need that property so that they can associate a push to a specific account instead of just an ssh key that can be associated to multiple accounts.
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by DangitBobby on Thursday August 22, 2019 @01:39AM (#20764989)
If they enforce a policy that key-user pairs are unique per project, then they know who to blame for any push.
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by mbesto on Wednesday August 21, 2019 @09:26PM (#20763783)
> we use separate accounts for different clients

Why though?

[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by tptacek on Wednesday August 21, 2019 @09:52PM (#20763914)
Because it would be crazy to link all our different clients to our personal Github accounts, or really to any single Github account.
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by DangitBobby on Thursday August 22, 2019 @01:53AM (#20765055)
GitHub recommends using a single account, according to their website[0]... I get that it could be seen as a security concern, but I don't know if it's crazy. I only accept a physical key as 2FA, and you can revoke SSH keys from your account if your development machine is ever stolen or missing.

0. https://github.community/t5/Support-Protips/Using-one-accoun...

[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by tptacek on Friday August 23, 2019 @01:51PM (#20780360)
Github is, pretty clearly, wrong about this.
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by mbesto on Thursday August 22, 2019 @03:39PM (#20771644)
Don't you find it a little crazy from a security perspective that you're using your machines for both personal and work purposes?
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by tptacek on Thursday August 22, 2019 @11:21PM (#20774288)
We're not; "personal" was just easier to write in the moment than "single long term durable account associated with Latacora".
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by mbesto on Friday August 23, 2019 @05:59PM (#20783102)
Ok so what advantage does that give you? The idea of PKI is that your identification is tied to your machine. Why are you unnecessarily conflating authorization with authentication?
[ Parent | on HN ]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by tialaramex on Thursday August 22, 2019 @03:13AM (#20765433)
If that would be "crazy" then I don't really see why you're so enthusiastic about using the same key for these "different" accounts.

I get how you can make it arguably safe, but it just seems like a needless risk exactly like a single shared account.

[ Parent | on HN ]