Are GitHub creds any harder for malware to steal than NPM creds? I don't see how... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		Ajedi32 47 days ago \| parent \| context \| favorite \| on: Shai-Hulud Returns: Over 300 NPM Packages Infected Are GitHub creds any harder for malware to steal than NPM creds? I don't see how that helps at all.

bpavuk 42 days ago [–]

well, if you talk about private SSH keys for Git operations and SSH/GPG keys for signing, then you'd better set up a passphrase on them, which GitHub strongly recommends. the passphrase will make it significantly harder to use the keys. so, as usual, It Depends (c)

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact