Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by LtWorf on Friday March 29, 2024 @09:23PM (#39870947)

As I said recently in a talk I gave, 2FA as implemented by pypy or github is meaningless, when in fact all actions are performed via tokens that never expire, that are saved inside a .txt file on the disk.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by heyoni on Saturday March 30, 2024 @12:37AM (#39871867)

Passwords have full scope of permission while session tokens can be limited.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by LtWorf on Sunday March 31, 2024 @03:35PM (#39887324)

In pypi to obtain a token that is limited in scope you must first generate an unlimited token.

True story.

In gh you can generate a limited one, but it's not really clear on what the permissions actually mean, so it's trial and error… which means most people will get tired and grant random stuff to have them working.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by heyoni on Sunday March 31, 2024 @04:42PM (#39887902)

I didn’t know that about pypi but github has seemed ok to me. I’ve also implemented my own scoped authentication systems so even if they’re not perfect I know it can be done

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by CapstanRoller on Friday March 29, 2024 @10:59PM (#39871451)

Doesn't GH explicitly warn against using non-expiring tokens?

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by yrro on Friday March 29, 2024 @11:31PM (#39871613)

I wonder what the point is, I don't remember GitHub warning me that I've used the se SSH key for years...

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by LtWorf on Saturday March 30, 2024 @02:03AM (#39872247)

And?

[ Parent | on HN ]