@thcipriani do you approve this as the manager of Release Engineering?

In T356852#9534981, @Mstyles wrote:

@thcipriani do you approve this as the manager of Release Engineering?

Hi @Mstyles yes, approved. We'd protect any credentials for this bot in the same way we're protecting access to the security patches themselves in our automated testing (since this bot will be used to update security tasks with the results of automated testing).

@thcipriani do you know if it's possible to add MFA to a bot account? I understand the team will be protecting credentials which is great. I looked around in the phabricator documentation and I didn't see anything, but I wanted to be thorough.

@Mstyles As you mentioned, there doesn't seem to be any references in the docs. Also, the settings section in the UI for bots doesn't offer MFA options, unlike the settings for a regular user.

I'm not sure how a MFA workflow for a bot would work, but intuitively (maybe I'm wrong) any extra authentication factor would need to be collocated with the current credentials (a conduit token) so the bot could access both securely. In that case, an attacker getting access to one of the factors would probably get access to both.

@jnuche I completely agree, I just wanted to make sure we were thorough in the approach. I'm creating a subproject for security bots in T357487 and after that's done, I'll go ahead and add security issue access.

@Mstyles thanks a lot!