Write your passwords down (2010)

Re:Write your passwords down (2010) by f1shy on Monday August 07, 2023 @01:09PM (#37037352)

I really do bot understand the policy of github. Before I could have a 40 char password in my head. Now it MUST be somewhere in my disc. I was totally surprised as I learned is the only way to login. Seems a 50 year old idea

[ Parent | on HN ]

Re:Write your passwords down (2010) by Wool2662 on Monday August 07, 2023 @01:46PM (#37037932)

And yet the likelihood of you telling someone or typing the contents of this file somewhere you shouldn't is much lower. It's more phishing resistant and is much less likely to be in some leaked password database, that's what GitHub cares about. Targeted attacks on single people don't even move the needle.

Phishing and password stuffing attacks are like 95% of 'hacking' attempts.

And frankly it is very likely that your 40 character password landed in your shell history at least once.

[ Parent | on HN ]

Re:Write your passwords down (2010) by predictabl3 on Tuesday August 08, 2023 @10:25AM (#37049439)

GH also prefixes them and undoubtedly scans for and invalidates them.

I don't think I ever cringe as much as HN threads with people clamoring for backwards steps for security.

[ Parent | on HN ]

Re:Write your passwords down (2010) by kasdi on Monday August 07, 2023 @07:50PM (#37042544)

Might want to check out 1Password CLI which can eliminate the need to store access tokens on disk.

[ Parent | on HN ]