News for hackers. Stuff that matters.

A comment on Attack campaign involving stolen OAuth tokens issued to third-party integrators. Parent comment

Re:Attack campaign involving stolen OAuth tokens issued to t... by media-trivial on Saturday April 16, 2022 @04:28AM (#31050677)
> If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository.

This. Limiting OAuth app access to specific repositories. I really wish this was a thing. For this exact reason I'm creating a new GitHub account for every new integration and share the repo with this account. It's technically against the TOS (they only allow single bot account per user) but there is no other way if you want security.

Maybe GitHub will implement this feature now. My hopes are high.

[ Parent | on HN ]
Re:Attack campaign involving stolen OAuth tokens issued to t... by kall on Saturday April 16, 2022 @05:34AM (#31050993)
Aren't OAuth tokens scoped to org? Wouldn't it be easier to create an org per repo? I guess it might get expensive depending on your usage/collaborators.

Edit: nevermind OAuth tokens are not org-scoped, only apps are

[ Parent | on HN ]