Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

71–80 of 353 posts

Re: Git password authentication is shutting down

#71

Post by lentil »

gigel82 wrote: post #55
vtbassmatt wrote: post #35

Disclosure: I'm the Git Systems PM at GitHub. Opinions are my own and I wasn't directly involved with this effort. GCM Core is a really straightforward way to auth with GitHub and several other Git hosts. It comes with Git for Windows by default, can be installed with `brew` on macOS, and from a .deb on Linux. https://github.com/microsoft/Git-Credential-Manager-Core (it started under the Microsoft banner but is maint…

GCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change. I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate ev…

While this probably doesn’t completely solve your problem, have you tried using conditional includes in your .gitconfig? I’ve been using that to ensure that anything under ~/work uses my work email for user.email, but anything under ~/projects uses my personal email. It’s quite handy.

https://git-scm.com/docs/git-config#_conditional_includes

Re: Git password authentication is shutting down

#72

Post by edgyquant »

edflsafoiewq wrote: post #64
young_unixer wrote: post #45

Earlier quoted context omitted.

Teaching git & Github to someone that doesn't know how to use a terminal is like teaching calculus to someone that doesn't know how to add. Of course you won't be able to do it in a couple of hours. Most people spend years learning the things that are required to understand how git works, or at least many months if you want to learn in a fast, intensive manner.

Doesn't have anything to do with knowing the terminal or not. Before getting up and running with git just involved typing git commands. Now one of the least mysterious parts to a newb (type in your password!) involves picking an external credential store that works on your OS, and figuring out how to install it, and setting it up with your PAT, and making git talk to it. That's a long way from stuff like "now type in…

Wait what? I just use keys generated by ssh and copied to GitHub it was way more straight forward than the git commands themselves to work on a given repo.

Re: Git password authentication is shutting down

#73

Post by batuhanicoz »

gigel82 wrote: post #55
vtbassmatt wrote: post #35

Disclosure: I'm the Git Systems PM at GitHub. Opinions are my own and I wasn't directly involved with this effort. GCM Core is a really straightforward way to auth with GitHub and several other Git hosts. It comes with Git for Windows by default, can be installed with `brew` on macOS, and from a .deb on Linux. https://github.com/microsoft/Git-Credential-Manager-Core (it started under the Microsoft banner but is maint…

GCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change. I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate ev…

I think you can achieve this with an SSH config like

  Host github-personal
  HostName github.com
  IdentityFile ~/.ssh/id_rsa_personal

  Host github-work
  HostName github.com
  IdentityFile ~/.ssh/id_rsa_work
Then you can use `github-work` or `github-personal` in the remote URL like `git clone git@github-work:mywork/somerepo.git`.

edit: I realized after reading the other comments that I got the problem wrong! This would push the commits from the correct GitHub account but the commits would still have the e-mail from git's config and GitHub would link the account in the committer e-mail.

Re: Git password authentication is shutting down

#74

Post by a-dub »

it seems about the only use case for passwords was cloning a private repository in an environment where you don't want keep your keys. that said, any environment where you don't want to keep your keys isn't necessarily a place you want to be typing in your account password anyhow.

human typable one time passwords for this purpose could be cool. although it's a pretty rare use case.

Re: Git password authentication is shutting down

#75

Post by Osiris »

amiga-workbench wrote: post #49
narraturgy wrote: post #46

Ok I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the d…

Key based auth is much more resistant to phishing. Its just one command to have openssh generate a key pair on your computer, and you're done. Password auth in general cannot go away fast enough.

Not in Windows unless you have WOL installed.

Re: Git password authentication is shutting down

#76

Post by foota »

RussianCow wrote: post #70
Wowfunhappy wrote: post #66

Earlier quoted context omitted.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

Presumably, the token is stronger than the passwords most people are using.

They can also be revoked more easily.

Re: Git password authentication is shutting down

#77

Post by overgard »

jareklupinski wrote: post #62
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

We just have to normalize it. Passwords were useful until better alternatives were available, and are around now to satisfy authentication based on 'something you know'. As long as the necessity is to verify something you know or something you have, a private key can be more convenient. People who prefer to enter through doors by entering a PIN instead of using a metal key will disagree. The thing left to do is make…

Pins are probably more secure than most metal keys (most locks are pickable < a minute)

Re: Git password authentication is shutting down

#78

Post by [deleted] »

RussianCow wrote: post #70
Wowfunhappy wrote: post #66

Earlier quoted context omitted.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

Presumably, the token is stronger than the passwords most people are using.

[deleted]

Re: Git password authentication is shutting down

#79

Post by Animats »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Setting up this authentication is a huge pain. First, the Github site lies to you. It tells me that, having previously generated a token, that token has never been used. It's been in use for months on one machine. Their web site and their repository system are not talking to each other.

Then they want you to generate a new token, in the "new format". Then they refuse to generate a token valid for more than a year. With a dark pattern where you push the "generate" button, but nothing happens.

Then comes dealing with Git itself. If you have a credential store file, there's no obvious way to log out of Git so that you get prompted for the new "authentication token". So I had to find out where it stores that data and delete the file. Then I could log back in with the new "authentication token". The documentation is written assuming you are using Git for the first time, not, as is more likely, updating an existing set of repositories.

(Why do I suspect that, at some point in the future, we will see "Log in with your Microsoft account?")

Re: Git password authentication is shutting down

#80

Post by bsder »

young_unixer wrote: post #45
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Teaching git & Github to someone that doesn't know how to use a terminal is like teaching calculus to someone that doesn't know how to add. Of course you won't be able to do it in a couple of hours. Most people spend years learning the things that are required to understand how git works, or at least many months if you want to learn in a fast, intensive manner.

And yet I can teach TortoiseHg to CEOs and secretaries in less than an hour.

But, hey, git is sooooo superior.

GitHub has done almost as much damage to version control as PowerPoint has done damage to presentations.

Post reply on HN