Hacker News Reader

Comment by 3pt14159 | Hacker News Reader

I want to be able to freeze this. Give me 30 days to OK a bulk data download. I don't want a single lost access token to have such an easy way for someone to get everything.

View on HN

When you request an archive of your data, we send the download link to your primary email address (the required token is not available via the web UI). Once you click that link, you'll be asked to re-enter your password. So for this particular feature, an attacker would need both your GitHub password (and your 2FA seed or an active session if 2FA is enabled) and access to your email.

There's also API (https://developer.github.com/v3/migrations/users/), which doesn't involve web UI or email.

The docs says it's "only available to authenticated account owners"; I hope it means you can't use a token for that, but I'm not sure.

A single lost access token that had global permissions already had the ability to get everything: GitHub’s API is already very full-featured.

The fix here is to use their scoping as intended: it should be amazingly rare to need an access token with such broad access.

A single lost access token + the API is an easy way to get everything too. It doesn't take much code to get everything that way.

Well then I want that to be locked down too! I'm sick of the all-or-nothingness of many of these security measures.

Really the lesson is to use constrained API tokens, going so far as to make single-purpose users as necessary.

Then don't create an API token with full access?

Reply on news.ycombinator.com