Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

21–30 of 353 posts

Re: Git password authentication is shutting down

#21

Post by nerdponx »

polote wrote: post #10
eropple wrote: post #9

Earlier quoted context omitted.

They do it to prevent passwords, which allow access to privileged things like account settings, from being stored (and thus subject to being accidentally leaked). It doesn't matter how long your password is if your password is in a text file with bad chmod permissions to people who shouldn't have it. An access token, at least, limits the blast radius.

Ah get it. They don't want the password to login on github to be the same as the one you store on a text file. Makes sense. But it is still Baby-sitting

If this is babysitting, I never want to grow up.

Re: Git password authentication is shutting down

#22

Post by geerlingguy »

justinator wrote: post #16
alpb wrote: post #5

tldr Git SSH protocol will still support authentication via username:password but in this case, the "password" can no longer be your Github Account password, but it can be a Personal Access Token. So no need to panic if you've been using a build system or other tool that authenticates with username:token instead of a SSH key.

TLDR? The article was three sentences!

Well, the comment was two :D

Re: Git password authentication is shutting down

#23

Post by nemetroid »

alpb wrote: post #5

tldr Git SSH protocol will still support authentication via username:password but in this case, the "password" can no longer be your Github Account password, but it can be a Personal Access Token. So no need to panic if you've been using a build system or other tool that authenticates with username:token instead of a SSH key.

This change affects HTTPS access, not SSH.

Re: Git password authentication is shutting down

#24

Post by hiimshort »

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces. Adding on ssh-keygen, key management adds even more friction.

It's certainly a difficult problem. How can we offer a more gentle learning curve for budding developers while still requiring "real" projects to use best practices for security and development?

Re: Git password authentication is shutting down

#25

Post by striking »

nemetroid wrote: post #23
alpb wrote: post #5

tldr Git SSH protocol will still support authentication via username:password but in this case, the "password" can no longer be your Github Account password, but it can be a Personal Access Token. So no need to panic if you've been using a build system or other tool that authenticates with username:token instead of a SSH key.

This change affects HTTPS access, not SSH.

https://github.blog/2020-12-15-token-authentication-requirem...

Workflows affected:

* Command line Git access

* Desktop applications using Git (GitHub Desktop is unaffected)

* Any apps/services that access Git repositories on GitHub.com directly using your password

Re: Git password authentication is shutting down

#26

Post by Androider »

Hopefully they'll enhance the other authentication methods. I was quite surprised how complicated yet insecure the GitHub Actions and personal access token mechanisms are just last week.

GitHub Actions tokens are scoped to the single repo they operate in, so for anything that you need covering any cross-repository or org access the official docs immediately tell you to just use a PAT instead. But PATs have no repository scoping whatsoever, it's all or nothing. So although both PATs and GHA Tokens have these complex scope requests, it's completely missing the most basic use cases in my opinion, like creating a PR in repo X, allow installing a package from GitHub Packages in repo Y, check out code from repo Z etc. You either go full mono-repo for everything, or you use PATs for everything with no repository boundaries at all, yikes.

Re: Git password authentication is shutting down

#27

Post by mynameisvlad »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Is there a reason one of the many git tutorials online wasn't good enough?

https://docs.github.com/en/get-started/quickstart/set-up-git https://www.atlassian.com/git/tutorials

This one's always fun: https://learngitbranching.js.org/ https://www.tutorialspoint.com/git/index.htm

Re: Git password authentication is shutting down

#28

Post by Operyl »

Androider wrote: post #26

Hopefully they'll enhance the other authentication methods. I was quite surprised how complicated yet insecure the GitHub Actions and personal access token mechanisms are just last week. GitHub Actions tokens are scoped to the single repo they operate in, so for anything that you need covering any cross-repository or org access the official docs immediately tell you to just use a PAT instead. But PATs have no reposit…

Yeah .. it's not great. Creating a machine user is really the only way to do it right now :(.

Re: Git password authentication is shutting down

#29

Post by nemetroid »

striking wrote: post #25
nemetroid wrote: post #23

Earlier quoted context omitted.

This change affects HTTPS access, not SSH.

https://github.blog/2020-12-15-token-authentication-requirem... Workflows affected: * Command line Git access * Desktop applications using Git (GitHub Desktop is unaffected) * Any apps/services that access Git repositories on GitHub.com directly using your password

Which one of those is non-HTTPS?

Re: Git password authentication is shutting down

#30

Post by Androider »

Operyl wrote: post #28
Androider wrote: post #26

Hopefully they'll enhance the other authentication methods. I was quite surprised how complicated yet insecure the GitHub Actions and personal access token mechanisms are just last week. GitHub Actions tokens are scoped to the single repo they operate in, so for anything that you need covering any cross-repository or org access the official docs immediately tell you to just use a PAT instead. But PATs have no reposit…

Yeah .. it's not great. Creating a machine user is really the only way to do it right now :(.

And they'll charge you the full seat price for it :/
Post reply on HN