Someone added an SSH key to my Github account
git, github, security, ssh
Solution
- Yes. GitHub client stays logged in untill you manually logout/uninstall/revoke access. The client app adds SSH key to your account automatically when you are logged in.
- Yes.
- Delete the key and revoke GitHub client access to your account. You will find it on the website under Account settings>Applications>Authorized applications. The client application on the windows machine will require user login once again to regain access to your account.
Problem
I just received an email saying "A new public key was added to your account". I checked my GitHub account and saw two keys - one was added by me several weeks ago from my Ubuntu machine, and one was added today from a Windows machine. This is a machine that I once worked on using GitHub client for Windows, but, I haven't entered it for several weeks now. My questions are: - Is it possible that another person got into that Windows machine and added a new public SSH key to my GitHub account? - Does this mean that anyone entering that Windows machine can do actions on my behalf in GitHub? - Besides deleting the new public key, how can I prevent people from adding new keys to my GitHub account?