Re:GitHub Raises $250M at $2B Valuation
by homakov on Wednesday July 29, 2015 @11:20PM
(#9973018)
How two factor auth will prevent loss of your source code? (assuming your password is unique)
[ Parent
| on HN ]
Keyloggers? Social engineering around the password reset function?
I use 2FA on all my personal accounts that support it (Twitter, Github, Gmail, Namecheap, banks).
Re:GitHub Raises $250M at $2B Valuation
by icebraining on Thursday July 30, 2015 @05:58AM
(#9974001)
If a software can log your keypresses, it can probably steal your cookies and log in as you from your machine. Cookies stored by browsers are easily readable by processes running as the same user.
It will help when my unique password get exposed through any of the many likely routes that don't give the attacker complete code execution on the servers - SQLi or using XSS to steal admin tokens for example.
Interesting, sqli that works only for reading encrypted_hash from DB? But since password is unique it cannot be bruteforced even locally.
True - it's the (many many documented[1]) cases where the SQLi grabs the password_cleartext column, not the encrypted_hash one that worry me here.