Why not use PAT?
replyI’ve grown to appreciate ssh should only be used with git for signing commits and as a deploy key (eg in a CI system).
I always use https for day to day git operations. My keys reside in gopass and are extracted by gopass-git-credential when needed by git.
I use that within devcontainers
PAT are vulnerable, once stolen they can be used from anywhere until their (usually) long term expiry.
replyBetter use short lived tokens with auto refresh. For example OAuth tokens. They can be used for the same use cases like PAT, but they expire after a max of 2 hours.
Which oauth tokens are you talking about? Because GitHub’s created by oauth or gh apps have a lifetime of either 8h or forever.
replyGitlab uses 2h. TIL that GitHub uses 8h.
reply2 hours is plenty. The recent binance hack was 20 minutes after all. A 2 hour token is enough time to get all that can be gotten or done by a token in almost any system especially well defined ones like GH or GL.
replyIt would be nice if GitHub or GitLab could limit a token to a given IP, but with how proxies and dynamic ips work I would imagine it would be a hassle to get it working correctly for everyone, but it’s better than nothing.
IP prefix should be enough to narrow down to your ISP + rough geographic location. Not perfect but requires no extra setup.
replyThose access token can still be stolen just the same. The Secure Enclave is better because you can ask it to authorise the action, but you can never get the key out of it, so the latest malicious npm package can’t send off your access tokens or ssh keys.
replyabsolute security does not exist, but each small improvement adds up. I quite like having to authorize each remote git action with Touch ID.
reply