Git password authentication is shutting down
github.blog
Git password authentication is shutting down
1–10 of 353 posts
Re: Git password authentication is shutting down
#2I wonder how many old, forgotten systems there are out there that pull from Github with a password. Brownouts are a smart way to try and weed those out, but there are going to be residual requests. I wonder how many.
Re: Git password authentication is shutting down
#3This is stupid, they only had to request passwords longer than 15 characters and that would have an even better effect. As web access will be also safer.
They do it to prevent password reuse, but still allow passwords on the web. I don't get it
Re: Git password authentication is shutting down
#4I don't know how disruptive this will be, but there are many much better options to authenticate against github besides a password.
Re: Git password authentication is shutting down
#5tldr Git SSH protocol will still support authentication via username:password but in this case, the "password" can no longer be your Github Account password, but it can be a Personal Access Token.
So no need to panic if you've been using a build system or other tool that authenticates with username:token instead of a SSH key.
Re: Git password authentication is shutting down
#6I have a noob question: what's the right way to use these tokens without password managers? I believe Github recommended assigning it as an environment variable in docs related to this deprecation, but isn't a (managed) server free to log the output of `echo $token`?
Re: Git password authentication is shutting down
#7Embrace. Extend. Extinguish
Re: Git password authentication is shutting down
#8This is stupid, they only had to request passwords longer than 15 characters and that would have an even better effect. As web access will be also safer. They do it to prevent password reuse, but still allow passwords on the web. I don't get it
You have a much more flexible interface with the user on the web than via git push.
Re: Git password authentication is shutting down
#9This is stupid, they only had to request passwords longer than 15 characters and that would have an even better effect. As web access will be also safer. They do it to prevent password reuse, but still allow passwords on the web. I don't get it
They do it to prevent passwords, which allow access to privileged things like account settings, from being stored (and thus subject to being accidentally leaked).
It doesn't matter how long your password is if your password is in a text file with bad chmod permissions to people who shouldn't have it.
An access token, at least, limits the blast radius.
Re: Git password authentication is shutting down
#10This is stupid, they only had to request passwords longer than 15 characters and that would have an even better effect. As web access will be also safer. They do it to prevent password reuse, but still allow passwords on the web. I don't get it
They do it to prevent passwords, which allow access to privileged things like account settings, from being stored (and thus subject to being accidentally leaked). It doesn't matter how long your password is if your password is in a text file with bad chmod permissions to people who shouldn't have it. An access token, at least, limits the blast radius.
Ah get it. They don't want the password to login on github to be the same as the one you store on a text file. Makes sense. But it is still Baby-sitting