> While our log analysis, conducted from March 5 through March 8, confirmed that this was a rare issue, it could not rule out the possibility that a session had been incorrectly returned but then never used. This was not a risk we were willing to take, given the potential impact of even one of these incorrectly returned sessions being used.
It is funny how they make it seem like they are super cautious. When in fact they had no other choice than do it when you rephrase the problem as " there were maybe some people who got the admin right of the github account of some of our customers"
You say that, but resetting all the sessions is very publicly visible and plenty of smaller companies would paper over such things. Honestly I don't really expect any less from Github or Microsoft scale but don't kid yourself into thinking that kind of things goes un-noticed, un-investigated or un-actioned elsewhere.
To the contrary, I find my session tokens get reset left and right by websites that don’t even care about how much of an inconvenience it is for the customers.
If your concern is tracking, clearing the cookies doesn't help much. Next day you will login on the same services and websites that you logged before, and if they share data with 3rd parties they will keep sharing it, with or without cookies.
"Delete cookies and site data when Firefox is closed" has always bothered me; it should be "Delete cookies and site data when Firefox is opened", because abnormal termination is not "closing", and you'd still want the cookies deleted when you start up again.
It is not. But a ton of sites seem to be inconsistent about it, or it feels that way at least. Some sites I frequent don't log me out for months at a time, and then suddenly they do. And then they do it again a few weeks later. Followed by multiple months of not doing it once more.
I use a food delivery service (website only, no app) that doesn’t even remember the chosen language setting, and of course, never keeps you logged in past 24hrs. So effectively, need to login every time I make an order...
That happens to me even on YouTube. Every couple of months I have to fix the language setting and switch back to dark theme. What can't be fixed are Google's weird attempts at auto-translating video titles from other languages, making me click on videos that I simply cannot understand. Don't do that, Google. Do full title, thumbnail and video translation with 90% accuracy or just...don't. Half-assed tech is easy but not helpful for anyone.
This is my biggest pet peeve about delivery service websites. What are the chances that I've moved house since I last ordered a pizza two days ago? Why do you incessantly ask for my postcode? When I log in, assume I'm the same person at the same address. If I have moved and accidentally order to the old house...well that's on me and I'd have to be pretty stupid (or hungry) to do such as thing.
Because Discord doesn't let you change avatars I have created three different Discord accounts. I get logged out of all three all the time. It's a massive pain.
Maybe part of the sentence is missing and they meant change avatars _per server_? That would be the only reason I can imagine someone might want to have multiple accounts.
Obviously if they are logging all actions of all users, and there's some decent retention period, they can find out how many people got unintended access and what all they did with it. Recently, I got an advice from a C-level executive to include such analytics in ASPSecurityKit [0], because that's what companies are looking for these days. This GH incident makes me consider his suggestion more seriously.
This points to the last A in AAA of security which stands for Authentication, Authorization & Accounting, AAA moniker is commonly used in reference to either RADIUS or Diameter (network protocols), the concept is widely used for software application security as well.
So Accounting implies What resources were accessed, at what time, by whom, and what commands were issued?
It is funny how they make it seem like they are super cautious. When in fact they had no other choice than do it when you rephrase the problem as " there were maybe some people who got the admin right of the github account of some of our customers"