4

I recently enabled 2-factor authentication (2FA) on my github account. Once you enable 2FA, you can no longer connect to the repo using your normal passphrase using command line tools. You have to create a personal access token.

At the endpoint, we use the personal access token (a string) in lieu of a passphrase.

Since a passphrase and a randomized string are arguably the same thing (disregarding entropy), how is one more secure than the other? Why force a personal access token in lieu of a password? What is the security benefit (again, other than entropy)?

Improve this question
2
  • 3
    Why do you ask 'other than the entropy'? The big benefit of an access token is the much higher entropy, compared to a typical password.
    – Jacco
    May 18, 2016 at 19:27
  • Because, it's easy to just generate high entropy passphrases for everyone if that's all it's about. So it's dumb to force the switch just because of the switch to 2FA.
    – James
    May 18, 2016 at 20:29

1 Answer 1

Reset to default
7

The security lies in that you have a unique "access token" per client. So you can revoke and control as you will. Look at for example, Googles "App Passwords" which are the same thing.

These tokens, of course make the 2FA no longer 2FA, but thats required for software and programs that do not support 2FA at all.

The idea is that if a token becomes compromised, you can revoke & renew that token, without jeopardizing access to your account or throwing out other clients.

Improve this answer
8
  • To expand on the middle point, "that's required for software and programs that do not support 2FA at all," having these tokens allows you to use 2FA when you can, even if you must have access without 2FA in specific situations, without weakening the 2FA where it is available. The security benefit is not intended for the command-line tools, it's intended for the online login; but I like you point about revoking credentials. I guess it even gives some benefit to those. :-)
    – Ben
    May 19, 2016 at 4:28
  • 1
    Using GitHub you also can restrict access for a specific token to certain parts of your account, which increases security (when using separate tokens for every client). The 2FA login secures your "front door" which would enable an attacker to create tokens on his own and access everything without restrictions.
    – Jonas Köritz
    May 22, 2016 at 19:11
  • 1
    IIUC the value proposition of a 2FA is that an attacker needs to steal two things: (i) my password; (ii) my OTP generator device. The latter is a physical device which needs to be physically stolen. Stealing a physical device requires skills and resources that are beyond that capabilities of the typical attacker. Thus, a personal access token -- such as the which I need to use for accessing github from my git client (command line program) -- seems to undermine this value proposition (modulo the fine-grained access control). Am I missing something?
    – Itay Maman
    Jul 16, 2018 at 12:41
  • Itay Marman: Exactly. But as you know, not all protocols and clients support the ability to use 2FA. In this case, you use a "access token", like a software token. Note that software tokens are not allowed to access "GitHub sudo access" or such.
    – sebastian nielsen
    Jul 16, 2018 at 12:49
  • 1
    @sebastiannielsen: I'd like to use 2FA to prevent incidents such as [1]. Forcing me to use a personal access seems like a step that denies of this level of protection. What are my options? [1] blog.npmjs.org/post/175824896885/…
    – Itay Maman
    Jul 16, 2018 at 13:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .