►
From YouTube: Connect to GitHub without a password #DemoDays
Description
How can GitHub help you secure your account and the projects that you work on? Jose Palafox, Director Technology Partnerships for GitHub advanced security and Luke Walker, Director, Developer Programs at Yubico talk through setting up a security key to SSH into your GitHub account and why passwords are now a thing of the past.
0:00 - Start
0:31 - Passwords are not sufficient, how can GitHub help you secure your account?
2:37 - The evolution of Account Security
3:51 - Our responsibility to developers
4:28 - Intro to Yubico
5:30 - Overview of the FIDO2 protocol
7:56 - The registration and authentication ceremonies
10:21 - SSH with Security Keys Demo
12:51 - Setting up SSH access to GitHub
14:27 - Verifying that the key is set up properly
17:21 - Resident keys and PINs
18:36 - What if my key is lost or stolen?
20:09 - Q&A
27:24 - Announcing GitHub Universe
https://www.yubico.com/
Secure at every step: https://github.com/features/security
https://githubuniverse.com
A
Hello,
hello,
linkedin
family.
Welcome,
welcome,
welcome
again
to
everyone
to
what
I'm
hoping
is
a
pretty
fun
demo
day
session,
we're
going
to
start
off
with
a
what
is
a
deceptively
simple
question:
how
do
you
connect
securely
to
your
account
to
help
me
with
this
topic?
I've
got
jose
palafox
director
technology
partnerships
for
github,
advanced
security,
as
well
as
a
special
guest,
luke
walker,
director
of
developer
programs
at
yubico,
jose.
B
Thanks
aj,
as
aj
mentioned,
I'm
jose
palafox
and
I
work
on
our
technology
partnerships
team,
covering
our
security
products
today.
What
we
want
to
talk
with
you
about
is
you
know
how
can
github
help
you
secure
your
github
account
and
the
projects
that
you
work
on
we've
known
for
a
long
time
that
passwords
are
not
a
sufficient
security
mechanism
for
protecting
sensitive
information,
people
tend
to
reuse
passwords,
people
can
have
their
credentials
purchased
online
and
people.
B
You
know
online
and
people
can
use
that
to
stuff
into
multiple
account
services
to
try
to
compromise
an
account
they're
subject
to
brute
force
accounts
where
people
just
try
to
guess
your
password
or
people
can
try
to
fish
you
for
your
password,
so
there's
lots
of
ways
to
get
around
passwords
by
themselves
and
at
github.
You
know
we
really.
We
really
want
to
fix
this
problem
and
most
attempts
at
fixing.
It
are
kind
of
poor.
B
What
will
happen
is
you
know,
a
systems
person
will
implement,
say
a
complexity
requirement
on
the
passwords
or
will
force
password
rotation
after
some
period
of
time
and
these
ways
of
trying
to
make
passwords
more
secure
tend
to
just
incentivize
the
user
to
go
around
them.
You
know
you
end
up
using
the
same
password
everywhere
or
incrementally
changing
one
capital
letter
or
you
know,
writing
your
passwords
down
because
they're
too
complicated
to
remember
and
that
sort
of
defeats
the
whole
purpose
of
trying
to
improve
password
security,
and
we
feel
like
for
developers.
B
We've
just
got
to
have
a
better
answer,
so
we've
been
partnering
with
ubico
for
some
time,
probably
since
2015
or
2012.
Maybe
it's
been
a
very
long
partnership
with
uvico
to
help
improve
account
security
using
ub
keys,
and
so
today
what
we
want
to
show
you
is
how
you
can
use
a
uv
key
to
set
up
ssh
access
to
your
github
account
and
store
the
credential
on
the
key
before
we
get
to
that.
I
want
to
spend
just
one
more
minute
on
some
of
the
steps
that
we've
taken
to
help.
B
In
2018,
we
started
blocking
the
use
of
known
bad
passwords
tapping
the
have.
I
been
pwned
data
set
to
identify,
already
leaked
credentials
and
prevent
you
from
using
a
password
that
has
already
been
compromised
and
then
in
2019
we
started
introducing
verified
devices
which
require
that
you
verify
when
you're
logging
in
from
a
new
device.
B
We
also
monitor
on
the
back
end,
if
you're
logging
in
from
geographically
impossible
locations
or
logging
in
from
a
new
geography
that
you
haven't
used
before
and
will
notify
you
that
there's
been
a
login
attempt
on
your
account
in
recent
years.
What
we've
been
doing
is
dropping
support
for
passwords
altogether
on
the
api.
You
can
no
longer
authenticate
to
github
using
a
password.
You
have
to
use
a
personal
access
token
or
some
kind
of
api
credential
to
authenticate,
and
recently
we
extended
that
to
ssh.
B
So
you
can't
ssh
to
github
and
execute
get
cli
operations
without
using
a
token-
and
this
isn't
done
just
to
you-
know,
help
you
be
more
secure.
It's
a
deliberate
attempt
to
secure
the
internet,
because
github
has
you
know
so
much
open
source
technology
on
it
that
underpins
sort
of
everything
we
do
in
modern
life,
and
so
we
think
it's
really
important
that
users
secure
their
account,
and
I
think
ubi
keys
are
a
great
way
to
secure
your
account.
B
C
As
you
mentioned,
we
kind
of
started
with
fido
u2f,
which
is
then
progressed
into
the
web
authen
specification
and
allowing
you
to
secure
your
account
with
a
security
key
and
the
benefits
that
web
authent
and
502
offer,
and
now
that
can
be
extended
to
your
ssh
git
operation.
So
your
one
security
key
can
like
protect
your
account
and
your
software
supply
chain
and
so
yeah
we're.
Let's
go
into
the
what
I'm
going
to
talk
about
today.
C
So
what
are
the
advantages
of
fido
2
as
jose
mentioned?
Passwords
can
be,
can
be
weak,
that's
how
most
data
breaches
occur,
and
so
what
502
brings
is
strong,
hardware-based
authentication
using
public
key
cryptography.
It
can
protect
against
phishing
session
hijacking
man
in
the
middle
and
malware
attacks.
There's
no
secrets
shared
between
services.
C
C
C
It's
that's
scalable
fighter,
2
in
combination
with
the
web.
Offense
back
is
just
works
out
of
the
box
with
leading
browsers
and
devices
that
we
use
every
single
day
and
for
application
development.
You
just
need
to
add
in
some
simple
api
calls
through
either
browser
or
a
native
sdk
library,
to
quickly
integrate
strong
authentication
into
your
products
or
services,
and
it
it
improves.
Usability
using,
I
feel,
using
hardware-based
keys
is
fast
and
easy.
C
It
enables
a
various
authentication
experiences.
You
can
have
your
second
factor
experience
where
your
username
password,
plus
a
physical
device,
a
security
key.
It
also
allows
multi-factor
authentication
from
the
key
itself.
So
it'll
have
you
possess
the
private
key
and
with
that
user
verification
feature,
there's
the
something
you
know
or
something
you
are
and
then
there's
an
option
called
password.
I
like
to
call
passwordless
authentication:
that's
where
you
don't
even
need
to
type
a
username.
You
can
do
everything
from
the
key
itself.
C
So,
let's
look
at
the
the
502
ceremonies,
really
quick,
I'm
going
to
quickly
cover
two
ceremonies:
the
there's
the
registration
ceremony
and,
in
our
case
the
ssh
key
gen
command.
That's
where
this
is
when
we're
registering
a
new
credential
on
the
security
key
and
then
we'll
next
we'll
go
into
the
ssh
or
authentication
ceremony.
C
So
when
we
look
at
this
command,
you
specify
the
options.
The
type
of
key
you
want
to
generate,
maybe
some
options.
The
ssh
client
is
going
to
create
some
client
data.
It's
going
to
send
that
to
the
security
key,
the
security
key
will
generate
a
private
public
key
pair.
It
will
use
that
private
key
to
sign
over
the
the
client
data
and
that
public
key
send
that
back
to
the
client.
It's
gonna.
C
The
client
can
then
verify
the
signature
using
the
public
key,
make
sure
nothing
was
tampered
with
and
everything's
good
to
go,
and
then
it'll
it'll
produce
the
the
private
and
public
keys
that
we're
used
to
seeing
every
day
and
when
we
use
ssh
and
then
what's
interesting.
To
note
here
is
that
this
private
key
is
not
really
where
your
private
bits
lie.
C
C
C
So
here
I've
got
my
terminal.
I've
got
my
yubikey
plugged
in
run,
ssh
keygen,
and
the
first
thing
you
need
to
know
is
what
kind
of
key
type
you
want
to
create.
So
you'll
notice
that
there's
we've
got
two
that
begin
with
dash.
Sk
we've
got
this
e
c
dsa,
and
this
ed25519
both
of
them,
have
the
dash
sk
at
the
end
that
stands
for
security
key.
So
these
are
the
two
types
of
ssh
keys
you
can
create.
C
C
Specify
the
type
let's
see
dsa
sk
and
we'll
just
call
this
xp
all
right.
Now
you
see
it's
it's
saying
I
need
to
touch
my
authenticator
so
that
here
I'm
providing
user
presence
and
touching
my
key
I'm
going
to
skip
the
passphrase
and
if
we
look,
I've
now
got
my
private
key
and
public
key.
So,
as
I
mentioned,
this
private
key
isn't
actually
the
actual
private
key.
C
It's
actually
like
a
reference
to
my
security
key,
and
so
all
the
sensitive
information
is
stored
on
the
security
key
itself,
and
so,
if
you're,
the
only
person
that
has
physical
access
to
the
security
key,
then
it's
safe
to
leave
it
plugged
in
at
all
times
all
right.
The
next
step
is,
we
want
to
set
up
our
access
to
github,
so
I'm
going
to
copy
this
test
key
to
my
ssh
directory.
C
C
C
C
C
C
C
C
All
right
now
just
touch
on
some
advanced
topics
such
as
you
feedback
here,
resident
keys
and
pins.
So
let's
say
you're
an
administrator
and
you
want
to
be
able
to
walk
up
to
any
workstation
and
plug
in
your
security
key
and
quickly
and
easily
set
up
ssh
access
securely.
Then
I
think
resident
keys
are
a
great
option
for
you.
C
You
just
run
the
ssh
keygen
dash
capital
k
and
that
will
produce
a
couple
of
your
public
and
private
key
files
in
the
current
directory,
and
then
you
can
use
them
like
you
normally
would
so
now
it's
important
to
note
that
anyone
who
has
possession
of
that
security
key
has
access
to
your
resources
right
when
they
have
the
resident
key
right.
They
get.
They
have
the
key
you
can
plug
it
into
a
machine.
You
generate
the
the
public
key
and
the
private
key
that
refers
to
it.
So
what?
C
If
your
key
is
stolen,
how
do
you
protect
that?
Well,
that's
where
that
that
we
touched
on
earlier
that
502
user
verification,
that's
where
that
comes
into
play,
so
you
can
set
a
use,
the
you
set
a
pin
or
use
a
biometric
and
enforce
that
on
every
time
you
want
to
use
the
key
by
passing
in
the
option,
verify
required.
C
So
when,
if
you
create
a
key
with
these
two
options,
you're
going
to
be
able
to
plug
it
in
on
any
computer,
generate
your
public
and
private
keys
on
demand
and
protect
access
with
a
pin
or
biometric
security
key.
Oh,
I
moved
ahead
too
far.
What
happens
if
you
lose
security
key,
then
you
won't
be
able
to
perform.
C
You
get
operations
so
or
ssh
operation,
so
make
sure
you
don't
lose
it,
and
I
would
encourage
everyone
to
create
a
backup
key
and
keep
it
in
a
safe
place,
and
so
you
just
repeat
the
steps
that
we
followed
to
do
that
so
yeah.
In
summary,
I
think
it's
been
great
partnering
with
github
and
bringing
modern
security
to
the
github
community.
C
B
So
if
you're
looking
for
more
things,
you
can
do
with
your
security
keys
like
backing
a
single
push
event,
you
can
check
out
our
white
paper
on
commit
signing
that
will
actually
walk
you
through
that
process.
We
wanted
to
kind
of
keep
this
user
flow
today.
Really
really
simple,
but
definitely
signing
commits
is
sort
of
the
next
201
topic
here.
You
can
scan
that
qr
code
to
check
that
out.
Also,
if
you
need
a
key
or
are
interested
in
setting
one
up,
you
can
get
one
from
the
github
shop.
B
Also,
when
they're
machine
generated
you
can
use
patterns
or
use
other
techniques
to
identify
that
it's
a
security
key
and
if
it
gets
leaked
products
like
github's
secret
scanning
can
identify
it
really
quickly
and
let
you
know
that
you've
accidentally
made
public
something
that
should
have
been
kept
private.
But
do
you
have
any
other
thoughts
on
why
why
using
keys
is
better
than
using
passwords.
C
Yeah,
I
think
you
you
hit
all
the
major
points
at
the
beginning
of
the
presentation
there.
They
can
be
fished
complexities
around
it,
you
know,
can
can
make
it
difficult
for
or
easier
for
attackers
to
find
this
shared
secret
right
where
security
keys
use
public
key
cryptography
in
the
background,
so
there's
no
secret
being
shared,
and
that's
that's,
I
think
that's
the
the
primary
reason.
We
call
that
strong
authentication.
B
B
We
also
have
github
code
scanning,
which
scans
or
performs
a
static
analysis
scan
on
your
software,
and
will
I
let
you
know
if
you've
introduced
known
bad
coding
patterns
into
your
software
and
catch
it
before
you
publish
it
so
kind
of
on
your
get
pull,
you
can
run
the
security
tool
and
analyze
the
source
code
for
for
any
known,
bad
patterns.
That
map
to
you
know
an
oasp
or
opencve,
or
something
of
that
sort
and
those
alerts
will
come
in
as
pr
comments
for
you
so
that
you
can
resolve
them.
B
B
I'm
scrolling
through
there's
quite
a
bit
of
chatter
here,
so
really
appreciate
the
the
involvement
here.
If
people
have
questions
feel
free
to
shoot
them
in,
I'm
I'm
seeing
them
as
quick
as
I
I
can
one
other
thing
we
can
tell
you
about.
If
you
want
to
step
back
a
slide.
Luke
is,
if
you'd
like
to
see
a
longer
version
of
this
presentation,
both
setting
up
the
ssh
keys
and
then
also
setting
up
commit
verification
which
we
talked
briefly
about.
B
You
can
go
ahead
and
scan
the
qr
code
there
on
the
screen
and
it'll.
Take
you
to
a
youtube
video
that
we
shot
to
kind
of
do
more
of
a
step-by-step
config
and
luke's
able
to
go
into
a
lot
more
of
the
detailed
configuration
options
than
we
did
today.
So
if
you
want
to
set
up
resident
keys
or
some
of
the
other
features
he
talks
about,
you
can
you
can
follow
along
on
that
video,
as
well
as
the
the
documentation.
B
There
are
a
couple
more
questions
in
here
that
I
don't
have
really
great
answers
for,
let's
see,
is
there
a
way
to
enable
mfa
for
code
push
and
pull
outside
of
trusted
networks?
I
I'm
not
sure
what
this
one's
asking,
but
I
will
circle
back
and
figure
out.
I
think
what
we're
showing
should
work
over
the
internet.
So
it's
it's
outside
of
a
trusted
network
for
sure,
and
it
can,
you
know,
be
used
to
connect
to
your
github.com
account
from
from
anywhere.
B
B
You
know
if,
if
you
have
10
minutes,
please
go
set
up
two-factor
on
your
github
account
it's
one
of
the
easiest
things
you
can
do
to
make
sure
that
you
don't
have
your
account
ever
compromised
and
I
think,
as
luke
showed
you
generating
you
know
the
token
and
getting
it
onto
your
key
is
really
just
a
couple
of
cli
commands
and
once
it's
set
up,
all
you
have
to
do
to
access.
Github
is
just
touch
the
key,
so
you
know
you
don't
have
to
memorize
passwords
anymore
and
you
don't
have
to
really.
B
A
Awesome
thanks
so
much
jose
and
luke
for
joining
us
today.
I
think
you've
laid
out
some
really
practical
steps.
You
know
I
I
know
that
most
folks
have
been
living
in
a
password
world
for
so
long
that
it
seems
like
maybe
maybe
we've
gotten
passwords
figured
out.
The
truth
is
it's.
It
hasn't
been
figured
out.
It's
been
figured
out
by
introducing
some
different
flows
to
things
so
hopefully
folks
will
enable
two-factor
authentication
and
keep
securing
their
their
accounts
awesome
so
to
close
out.
A
I'd
also
like
to
give
a
quick
plug
to
github
universe.
If
you
like
this
subject
as
well
as
a
lot
more
fun
stuff
that
we're
going
to
be
revealing
during
universe,
we've
got
a
two-day
event
coming
up
at
the
end
of
october.
It's
actually
pretty
brief,
only
two
hours
of
live
programming
per
day,
but
there
are
also
a
lot
of
options.
So
if
you
do
see
something,
that's
exciting
on
the
schedule,
go
ahead
and
go
to
githubuniverse.com
to
keep
updated,
and
it
should
be
a
really
really
super
fun
event
with
that.