Accounts And Secrets

An account is your personal identity on a service. A credential, such as a password, token, private key, or recovery code, proves that identity. A Git commit records a version of files in project history, so a credential added to Git can remain exposed even after the visible line is deleted.

Goal: use personal accounts safely and recognize information that must never be shared or committed.

Prerequisites: none.

Execution context: this is a reading and scenario module. Do not paste real credentials into any exercise.

Personal Accounts Stay Personal#

Your ETH, GitHub, Euler, storage, and software accounts identify you. Do not share them with another student, supervisor, or support person. You are responsible for actions performed under your account.

Protect all of the following:

• ETH and GitHub passwords;
• MFA and recovery codes;
• GitHub, Hugging Face, W&B, cloud, and package-registry tokens;
• .env files containing credentials;
• SSH private keys such as id_ed25519;
• browser sessions and password-manager exports.

MFA and 2FA both mean that the service asks for a second proof after the password. A token is secret text that lets a program use an account. An .env file commonly stores local program settings and may contain tokens or passwords.

An SSH public key normally ends in .pub and may be installed on a server. The matching private key never leaves your computer and is never sent in chat.

Set Up Account Protection In This Order#

1. Keep an approved password manager if you already use one. If you do not, follow the ETH KeePass guidance. Use KeePassXC on a personal computer; ask the responsible IT support before installing software on an ETH-managed device.
2. Give every service a different generated password. Do not store ETH passwords in an unapproved cloud-hosted vault.
3. Open GitHub password and authentication settings and enable two-factor authentication.
4. Configure the recovery methods offered by GitHub. Store recovery codes in the approved private location, close the recovery-code view, and never send a code as evidence.

The Passport checks your understanding, not your credentials. It never asks for a password, one-time code, recovery code, private key, or password-manager database.

Safe Authentication Order#

1. Prefer an approved browser or command-line (CLI) login flow supplied by the service.
2. Use SSH keys with a passphrase when required for remote access.
3. Use narrowly scoped, expiring tokens, such as a personal access token (PAT), only when the first two options do not fit.
4. Never store a token directly in source code, a notebook, a command history, or repository documentation.

Scenario: A Token Was Committed#

Deleting the line in a later commit does not make the token safe; it may remain in Git history, forks, caches, or logs.

Safe response:

1. Revoke or rotate the credential immediately.
2. Tell the repository owner or supervisor what happened.
3. Remove the credential from the current code.
4. Ask the repository owner whether history cleanup is required.
5. Review logs for suspicious use.

Do not post the token in an issue while asking for help.

AI-Agent Boundary#

An agent may inspect filenames such as .env.example, but it must not read a real .env, SSH private key, token store, or browser credential database. Explicitly exclude those files from the task.

Inspect the authentication code, but do not open .env files, key files,
credential stores, or any file ignored by Git. Do not print secret values.

Verification#

You understand this module if you can explain:

• the difference between an SSH public and private key;
• why deleting a leaked token from the latest file is insufficient;
• why support personnel do not need your password;
• which authentication method should be preferred before a personal access token.

Common Failure And Safe Recovery#

A tool asks you to paste a secret into chat. Stop, cancel the action, and use the tool's approved login command or browser flow. If the secret was already sent, revoke it and report the incident.

Ask For Help When#

• you suspect an account was used by someone else;
• a secret entered Git history or an agent transcript;
• MFA or account recovery no longer works;
• instructions appear to require copying a private key.

Continue with Data Classification And AI Tools.