5

I am concerned to let any team member in with a weak password on my dev team but I do not see a way to enforce that as a requirement in GitHub. Is this possible?

The concern is that a team members account gets hacked and then private source code becomes accessible to the world or competitors.

5

GitHub does not provide any way to set custom password policies; all accounts are independent. (Implementing such support would require the passwords to be stored in a plaintext/decryptable form, which is even worse for security.)

You could set up your own Git server – using Gitolite if you need detailed access control, but even pushing over plain SSH would allow you to set up your own policies.

GitHub being Git, however, it's next to impossible to do any permanent damage to the data – every team member has a copy of the entire version history.

  • 1
    "would require the passwords to be stored in a plaintext", disagree. forcing this can and should be done at the event of setting the password, at this point the passowrd is known, the saved data should be then hashed. – JAR.JAR.beans Jan 13 at 12:59
0

You cannot enforce a new password policy, but if you can enforce two-factor authentication in your organization's settings, in the Security tab:

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy