vermiculus / magithub

**DEPRECATED - please use Forge instead!** -- Magit-based interfaces to GitHub
GNU General Public License v3.0
579 stars 63 forks source link

Add some documentation for two-factor auth #292

Closed Blaisorblade closed 6 years ago

Blaisorblade commented 6 years ago

First, thanks for this package!

Figuring out support for two-factor authentication (2FA) wasn't trivial. Since there isn't a wizard where to paste a token and check it's correct, at least add some summarized docs, specialized for magithub—since Ghub's docs can't contain client-specific information.

Notes:

Security

I'm also not sure what's adequate security for the token. Ghub's docs only say

Secrets are stored in ~/.authinfo in plain text. If you don’t want that (good choice), then you have to customize auth-sources, e.g. by flipping the positions of the first two elements.

but I don't have GPG setup at all, let alone setup with Emacs and I don't plan to shave that yak yet — customizing auth-sources can't possibly be enough?

EDITED: So I guess that for users without 2FA tokens do get written in cleartext in ~/.authinfo? Guess that's unavoidable until support for keystores is automated enough, and a tolerable compromise on "secure enough" client machines.

Blaisorblade commented 6 years ago

Build failures https://travis-ci.org/vermiculus/magithub/jobs/345908758#L1070 and https://travis-ci.org/vermiculus/magithub/jobs/345908759#L1080 appear unrelated to my PR (right?), so please don't hold them against it.

vermiculus commented 6 years ago

Re Travis builds: yeah, it does that sometimes. It's supremely annoying, but there's an open ticket about it somewhere on debbugs I think.

vermiculus commented 6 years ago

Related: magit/ghub#47

vermiculus commented 6 years ago

Hard-wrapped and used Org syntax. Thanks!