Replies: 9 comments 9 replies
-
|
I was about to post similarly; I'd just like to add: in the announcement blog post there's this explanation:
I'd be keen to request that this be reconsidered - it would be great if As-is, users roughly have a choice between hardware key always requiring taps, and an in-software (keys on disk + ssh agent). The former being very secure but inconvenient, the latter being not very secure but convenient. I would think there are plenty of people for whom a hardware key is appealing for its ability to limit compromise of private keys, who would be willing to forego the added protection that user presence detection gives. I'd argue that lack of a middle ground option is going to pressure people towards the least secure option, so think that it would be really nice if GitHub could reconsider this approach. |
Beta Was this translation helpful? Give feedback.
-
|
GitHub could just allow prefixing the pubkey with It is sad that there's no answer to this after over two years. |
Beta Was this translation helpful? Give feedback.
-
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
-
|
It could be allowed, via opt-in, for SSH Authentication Keys at least. Edit: Already works for signing since that process is entirely local. |
Beta Was this translation helpful? Give feedback.
-
|
This issues is very annoying, I need to touch yubikey all the time. Is there any option to raise this with GitHub? |
Beta Was this translation helpful? Give feedback.
-
|
Good news everybody! I've got a workaround - keep ssh session: |
Beta Was this translation helpful? Give feedback.
-
|
I gave up on this and switched to using SSH keys stored in 1Password. Github sees them as being provided by an SSH agent, so doesn't prompt every time, and 1Password allows to your require MFA to unlock the vault if you like and can you set your own policy for how frequently you need to re-enter the password. The goal if not storing the private keys directly on your laptop is met either way. |
Beta Was this translation helpful? Give feedback.
-
|
Just gonna add another on the pile saying I'd like to see this added. With an account that doesn't have anything particularly sensitive on it, I'd be more than happy to give up a bit of security in order to not require the user presence confirmation on my Yubikey. Could hide an opt-in option within account settings somewhere, but allowing it would be great. |
Beta Was this translation helpful? Give feedback.
-
|
Another perspective/opinion: While not a problem of github - VSCode has microsoft/vscode#164402 opened for 3 years (openssh writes "Confirm user presence for key" which vscode/git misinterprets). So having to use touch is even less feasible when working with it. Yes - it's a vscode issue but that is exactly... My point is that security needs to be practical or it is not used. And this is IMO what's happening here too. Honestly - the few people actually using FIDO keys and set it up in github (and prefixing it with 'no-touch-required') probably know what they are doing. So in essence my opinion is that it would improve rather than harm the situation if no-touch would be accepted. For the time being my Private-Key is now also NOT in HW but in my PW-Manager. Point (at least for me) proven 😛. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Per the
ssh-keygendocs,sktype ssh keys have an option to disable touch presence via passing-O no-touch-required.sshdrejects such signatures by default, but this can be changed by addingno-touch-requiredto the authorized_keys option.It would be nice for
no-touch-requiredsk keys to be supported, via some interface when adding ssh keys on the webui.Beta Was this translation helpful? Give feedback.
All reactions