A better summary. [LWN.net]

A better summary.

Posted Jun 12, 2026 16:01 UTC (Fri) by LtWorf (subscriber, #124958)
In reply to: A better summary. by anselm
Parent article: Eliminating long-lived credentials with trusted publishing

I think it's extremely funny that instead of forcing people to use 2FA to do uploads, they forced 2FA to login, and then you create a long lived all-powerful token and forget about 2FA.

I was doing uploads by typing in my password (not stored in any password manager), and now the only way I can do uploads (without moving my projects on a corporate-owned forge) is via a token which sits on my disk, ready to be stolen.

Google gave me an hardware token for free, but it only works for web login.

All of this effort and I'm now less secure than I was a few years ago. Which makes me strongly suspect that ballombe's take is the right one. USA is adding constraints to foreign companies forcing them to avoid any chinese software to be able to sell anything in USA…

to post comments

A better summary.

Posted Jun 15, 2026 1:27 UTC (Mon) by mathstuf (subscriber, #69389) [Link]

For services with these kinds of things that they're "important" *and* require unencrypted passwords (I've migrated most everything else over to systemd-creds instead now), I instead store the relevant config file as a symlink to an automounted drive that is named through udev/udisks to a stable `/dev/mapper` name.

So, yes, still long-lived, but it doesn't need to be accessible just because I'm logged in (or even just booted as the common case may be).