Documentation of MFA and other Security Concerns

[scheidelg]

Make sure to note the use of MFA being encouraged.

User ID / password information is given to the web site, to do whatever it wants - bad.

note that user id / password via API is being deprecated Nov 2020 (provide URL)

Personal access tokens, limited scope (read:org) seems to be the most restrictive that we can use), can be revoked - good

• give instructions!
• provide URL references
  • creating an access token: https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
  • removing access tokens

PAT notes

So, option #1:

• grant users access to your repository
• create a GitHub personal access token, grant it read:org privs

downsides

• It's a 40-digit hexadecimal character that will be cleared from memory the next time you close your browser, then you'll have to re-enter it
• The user is still granting access to all the repositories to which they have access, within the scope of the token; the ONLY scope that works is "repo" which grants "full control of private repositories" (all private repositories)
• one year expiration that can't be changed

upsides

• not as bad as logging in as the user, assuming you've limited the scope of the token
• token expires in 1 year even if you forget about it
• user can revoke the token (need URL here)