Uploaded image for project: 'Bitbucket Cloud'
  1. Bitbucket Cloud
  2. BCLOUD-3733

Recommend that SSH security features mirror those at github.com

    XMLWordPrintable

Details

    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

    Description

      I just received this email from github.com and I would recommend that the same features be implemented at bitbucket.org .

      Cheers,
      Tony

      "A security vulnerability was recently discovered that made it possible for an attacker to add new SSH keys to arbitrary GitHub user accounts. This would have provided an attacker with clone/pull access to repositories with read permissions, and clone/pull/push access to repositories with write permissions. As of 5:53 PM UTC on Sunday, March 4th the vulnerability no longer exists.

      While no known malicious activity has been reported, we are taking additional precautions by forcing an audit of all existing SSH keys.

      === Required Action ===

      Since you have one or more SSH keys associated with your GitHub account you must visit https://github.com/settings/ssh/audit to approve each valid SSH key.

      Until you have approved your SSH keys, you will be unable to clone/pull/push your repositories over SSH.

      === Status ===

      We take security seriously and recognize this never should have happened. In addition to a full code audit, we have taken the following measures to enhance the security of your account:

      • We are forcing an audit of all existing SSH keys
      • Adding a new SSH key will now prompt for your password
      • We will now email you any time a new SSH key is added to your account
      • You now have access to a log of account changes in your Account Settings page

      Sincerely, The GitHub Team"

      Attachments

        Activity

          People

            Unassigned Unassigned
            330d83f34764 tohagan
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: