Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

51–60 of 353 posts

Re: Git password authentication is shutting down

#51

Post by cyral »

narraturgy wrote: post #46

Ok I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the d…

You forgot about the part where you run `git push` later and realize it didn't save your passkey, so you have to make another one. This time you Google how to save it and copy the top answer on StackOverflow, which uses the git credentials store to save it in plain text in your ~/.gitconfig file. Now is the passkey more secure?

Re: Git password authentication is shutting down

#52

Post by HeckFeck »

toiletaccount wrote: post #47
HeckFeck wrote: post #37

Earlier quoted context omitted.

Indeed. I wish there was something like a token or key that was as ubiquitous as passwords. Though from a developer POV I can certainly see why passwords are so attractive: take a word, hash it, compare hash on subsequent logins. The alternatives are tricky, but not I suspect impossible, to do in a decentralised manner. I've often pondered that something like PGP servers with revocation certificates, but adapted to l…

Do you want to be the one to explain PGP and revcerts to somebody who has used the same password for everything their whole life?

That's why I said 'something like'. An extension of the idea adapted for wider use.

I'm certain such a person uses TCP/IP every day and doesn't need it explained. Yet twenty years ago, some knowledge of IP addresses and subnet masks etc was necessary to get connected.

Re: Git password authentication is shutting down

#53

Post by post-it »

BeefySwain wrote: post #39
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

> Think, having your graphics designer able to make commits, or having someone who only wants to update docs.

GitHub's web interface is pretty good for this.

Re: Git password authentication is shutting down

#54

Post by brtknr »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Fifficult indeed

Re: Git password authentication is shutting down

#55

Post by gigel82 »

vtbassmatt wrote: post #35

Disclosure: I'm the Git Systems PM at GitHub. Opinions are my own and I wasn't directly involved with this effort. GCM Core is a really straightforward way to auth with GitHub and several other Git hosts. It comes with Git for Windows by default, can be installed with `brew` on macOS, and from a .deb on Linux. https://github.com/microsoft/Git-Credential-Manager-Core (it started under the Microsoft banner but is maint…

GCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change.

I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate every time and manually check each clone's .git/config.

Re: Git password authentication is shutting down

#56

Post by omnibrain »

pjc50 wrote: post #48
BeefySwain wrote: post #39

Earlier quoted context omitted.

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

The solution that everyone actually uses until they learn the unnecessary details is "take a backup of relevant files and blow away & redownload the repo".

Relevant xkcd: https://xkcd.com/1597/

Re: Git password authentication is shutting down

#57

Post by [deleted] »

narraturgy wrote: post #46

Ok I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the d…

[deleted]

Re: Git password authentication is shutting down

#58

Post by spondyl »

For any Githubbers reading, my coworker was apparently affected by a brownout window and changed to using a personal access token. He didn't know it at the time but I just mentioned the period and it lines up with when had issues with his authentication. Seems like a success if you ask me!

Re: Git password authentication is shutting down

#59

Post by spondyl »

For any Githubbers reading, my coworker was apparently affected by a brownout window and changed to using a personal access token. He didn't know it at the time but I just mentioned the period and it lines up with when had issues with his authentication. Seems like the brownout was a success in our case!

Re: Git password authentication is shutting down

#60

Post by funtime »

tcoff91 wrote: post #44
hiimshort wrote: post #32

Earlier quoted context omitted.

In this case it is a younger college student who's interested in web development but hasn't done any CS learning and isn't generally familiar with tech.

Does someone who just wants to experiment with a little bit of web-dev really need to have version control right away? Seems a bit out of scope. That seems like a concept that can wait a few months while they actually just explore writing some code first.

or start with svn or something simpler to get the basics of source control.
Post reply on HN