Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

61–70 of 353 posts

Re: Git password authentication is shutting down

#61

Post by chrisshroba »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Just so folks know, you can still use personal access tokens, which basically work as per-application passwords. For someone just getting started with git, I'd recommend they go to https://github.com/settings/tokens, generate a token, and then they can just use that as their password when running `git clone`.

This will certainly be a little more difficult for newcomers, and not very discoverable, but it is there.

Re: Git password authentication is shutting down

#62

Post by jareklupinski »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

We just have to normalize it.

Passwords were useful until better alternatives were available, and are around now to satisfy authentication based on 'something you know'. As long as the necessity is to verify something you know or something you have, a private key can be more convenient.

People who prefer to enter through doors by entering a PIN instead of using a metal key will disagree.

The thing left to do is make maintaining this private key as frictionless as adding a metal key to my IRL keychain. The kids may have some good ideas :)

Re: Git password authentication is shutting down

#64

Post by edflsafoiewq »

young_unixer wrote: post #45
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Teaching git & Github to someone that doesn't know how to use a terminal is like teaching calculus to someone that doesn't know how to add. Of course you won't be able to do it in a couple of hours. Most people spend years learning the things that are required to understand how git works, or at least many months if you want to learn in a fast, intensive manner.

Doesn't have anything to do with knowing the terminal or not. Before getting up and running with git just involved typing git commands. Now one of the least mysterious parts to a newb (type in your password!) involves picking an external credential store that works on your OS, and figuring out how to install it, and setting it up with your PAT, and making git talk to it. That's a long way from stuff like "now type in git add -A".

Re: Git password authentication is shutting down

#65

Post by the8472 »

post-it wrote: post #53
BeefySwain wrote: post #39

Earlier quoted context omitted.

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

> Think, having your graphics designer able to make commits, or having someone who only wants to update docs. GitHub's web interface is pretty good for this.

Until you need them to rewrite history because it consists of 20 "fix" and "update" commits.

Re: Git password authentication is shutting down

#66

Post by Wowfunhappy »

chrisshroba wrote: post #61
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Just so folks know, you can still use personal access tokens, which basically work as per-application passwords. For someone just getting started with git, I'd recommend they go to https://github.com/settings/tokens , generate a token, and then they can just use that as their password when running `git clone`. This will certainly be a little more difficult for newcomers, and not very discoverable, but it is there.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager.

Okay, no big deal, I just have to spend an extra second searching for the copy password icon, since it’s not in the same place as every other account password—but did this really improve my security at all? It’s just a different password.

Re: Git password authentication is shutting down

#68

Post by chipotle_coyote »

gigel82 wrote: post #55
vtbassmatt wrote: post #35

Disclosure: I'm the Git Systems PM at GitHub. Opinions are my own and I wasn't directly involved with this effort. GCM Core is a really straightforward way to auth with GitHub and several other Git hosts. It comes with Git for Windows by default, can be installed with `brew` on macOS, and from a .deb on Linux. https://github.com/microsoft/Git-Credential-Manager-Core (it started under the Microsoft banner but is maint…

GCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change. I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate ev…

Can't you still use https with this? You use the personal account token for the specific account to log in as the "password". I've been doing this recently with two GitHub accounts.

In my ~/.gitconfig file, I've included

    [credential "https://github.com"]
        useHttpPath = true
Which means that the first time -- and only the first time -- I try to do something with a GitHub repo that requires authentication, I'll be asked for the username and password (token), and I make sure to use the right one. :) At that point things stay set.

Re: Git password authentication is shutting down

#69

Post by edgyquant »

young_unixer wrote: post #45
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Teaching git & Github to someone that doesn't know how to use a terminal is like teaching calculus to someone that doesn't know how to add. Of course you won't be able to do it in a couple of hours. Most people spend years learning the things that are required to understand how git works, or at least many months if you want to learn in a fast, intensive manner.

Yeah. I start using git for personal projects in 2015 and didn’t even know about git diff until last year. All I knew was how to git add, git commit, pull and push. If anything tricky happened I just copied my changes, deleted the repo and recloned. I don’t think you need to teach git beyond those few commands to people but even then I’ve been using bash since I was a kid playing with openSuse so I’d imagine there’s a lot of bash experience that made it easier for me to pick up. I can’t imagine someone who’s never typed ls will have an easy time picking it up.

Re: Git password authentication is shutting down

#70

Post by RussianCow »

Wowfunhappy wrote: post #66
chrisshroba wrote: post #61

Earlier quoted context omitted.

Just so folks know, you can still use personal access tokens, which basically work as per-application passwords. For someone just getting started with git, I'd recommend they go to https://github.com/settings/tokens , generate a token, and then they can just use that as their password when running `git clone`. This will certainly be a little more difficult for newcomers, and not very discoverable, but it is there.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

Presumably, the token is stronger than the passwords most people are using.
Post reply on HN