← Back to context

Comment by stavros

21 hours ago

All the attackers need to do is steal an SSH key and they'd be able to clone everything, no?

Nah GitHub/MS doesn't allow SSH keys for their internal stuff. You have to use git-credential-manager, which enforces MFA

Depends how it's set up. Many companies add an IP address check so if you don't come via their VPN (or are not in the office) the connection will be rejected before any auth is asked.

So you'd need to authenticate for the VPN, which often has 2nd factor.

But I have no idea of how they are set up.