Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

81–90 of 353 posts

Re: Git password authentication is shutting down

#81

Post by verdverm »

nemetroid wrote: post #29
striking wrote: post #25

Earlier quoted context omitted.

https://github.blog/2020-12-15-token-authentication-requirem... Workflows affected: * Command line Git access * Desktop applications using Git (GitHub Desktop is unaffected) * Any apps/services that access Git repositories on GitHub.com directly using your password

Which one of those is non-HTTPS?

git@github.com:org/repo where you've set it up to use username:password

People who've put this information in a netrc file may see downstream issues in several applications which auth with info found therein

Re: Git password authentication is shutting down

#83

Post by kiwijamo »

Osiris wrote: post #75
amiga-workbench wrote: post #49

Earlier quoted context omitted.

Key based auth is much more resistant to phishing. Its just one command to have openssh generate a key pair on your computer, and you're done. Password auth in general cannot go away fast enough.

Not in Windows unless you have WOL installed.

Windows comes with ssh by default these days so you can easily ssh-keygen. Doesn't need WOL as I used that without WOL.

Re: Git password authentication is shutting down

#84

Post by kevincox »

foxpurple wrote: post #34
Androider wrote: post #30

Earlier quoted context omitted.

And they'll charge you the full seat price for it :/

GitLab now has project access tokens for that.

If you have a "project" not a "user". If I'd known this in the past I would have just created a "kevincox" project and a "kevincox-u" user.

Re: Git password authentication is shutting down

#85

Post by geofft »

Wowfunhappy wrote: post #66
chrisshroba wrote: post #61

Earlier quoted context omitted.

Just so folks know, you can still use personal access tokens, which basically work as per-application passwords. For someone just getting started with git, I'd recommend they go to https://github.com/settings/tokens , generate a token, and then they can just use that as their password when running `git clone`. This will certainly be a little more difficult for newcomers, and not very discoverable, but it is there.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

I would guess that "in my password manager" immediately puts you into the minority of GitHub users. (Maybe not the minority of power users or high-profile software maintainers, to be fair, but they care about security for the site in general.)

So maybe it didn't improve your security, if you were already letting your password manager generate distinct passwords, but it almost certainly improves the median user's security, who has come up with a weak password they think is strong, and may well use that password on multiple websites.

Generating the accout password instead of allowing a user-supplied password would also work here (and incentivize the use of password managers, if enough websites did it), but I would guess getting people onto SSH keys is useful for them in general - e.g., it allows them to make 2FA or CAPTCHAs mandatory for use of high-abuse-potential features like CI or Codespaces.

Re: Git password authentication is shutting down

#86

Post by runj__ »

narraturgy wrote: post #46

Ok I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the d…

I'm also a dingus and I am sometimes forced to clone private repos to new machines which doesn't have my keys. I know that ssh-agent is a thing which is sometimes set up but I still don't really know how it works, and sometimes it doesn't work at all with weird proxy servers and whatnot.

I wish there was some way of _manually_ identifying via a simple link or QR code or whatever.

Re: Git password authentication is shutting down

#87

Post by tomrod »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Github Desktop I've found to be an excellent way to get people into git generally. Those with proclivities to GUI get what the need, those that like to explore have some initial guardrails.

Re: Git password authentication is shutting down

#88

Post by lanstin »

eropple wrote: post #9
polote wrote: post #3

This is stupid, they only had to request passwords longer than 15 characters and that would have an even better effect. As web access will be also safer. They do it to prevent password reuse, but still allow passwords on the web. I don't get it

They do it to prevent passwords, which allow access to privileged things like account settings, from being stored (and thus subject to being accidentally leaked). It doesn't matter how long your password is if your password is in a text file with bad chmod permissions to people who shouldn't have it. An access token, at least, limits the blast radius.

I doubt this "saved passwords" is the issue, but people choosing guessable passwords. Especially with the bit-coin attacks on the Github CI sandboxes, thee attackers don't care about the repo that much but they want access to the X% of github accounts that use a top 100 or top 1000 password, so they can get in and start mining.

Re: Git password authentication is shutting down

#89

Post by mrosett »

tcoff91 wrote: post #44
hiimshort wrote: post #32

Earlier quoted context omitted.

In this case it is a younger college student who's interested in web development but hasn't done any CS learning and isn't generally familiar with tech.

Does someone who just wants to experiment with a little bit of web-dev really need to have version control right away? Seems a bit out of scope. That seems like a concept that can wait a few months while they actually just explore writing some code first.

Totally agree on this. So many coding (or even data science) courses start with Git which is just not that important for a newbie.

Re: Git password authentication is shutting down

#90

Post by jampekka »

So now I can't use git client on github repos anymore without carrying a device that has some impossible to memorize key or token on it?

I hate it. I don't care much for the slight chance that someone gets into my github account. I care a lot more that now I have to jump hoops to get into my account myself. There's more to things than security.

Post reply on HN