Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

101–110 of 353 posts

Re: Git password authentication is shutting down

#101

Post by [deleted] »

RussianCow wrote: post #70
Wowfunhappy wrote: post #66

Earlier quoted context omitted.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

Presumably, the token is stronger than the passwords most people are using.

[deleted]

Re: Git password authentication is shutting down

#102

Post by WorldMaker »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Most modern credential managers for git understand GitHub logins. If you copy and paste the HTTPS address for a GitHub repo (rather than the git ssh git: address) a git credential manager will give you a GitHub login dialog (classic username/password dialog with optional 2FA check) and then do the dance for you to get (and securely cache) an access token for you. No SSH key management required and the flow still feels similar (you type your username and password into the web browser wrapped as a dialog box with the GitHub logo and address).

Git for Windows and most Linux distributions of git today include such a credential manager out of the box. Generally the only thing that needs to change to move to that workflow is adjust the muscle memory to grab HTTPS addresses, not git: addresses. (Which shouldn't be an issue for new people learning it for the first time, and GitHub's own UI has worked to get better at pushing the HTTPS links first.)

ETA: A link for the main tool that provides this user flow: https://github.com/microsoft/Git-Credential-Manager-Core

Re: Git password authentication is shutting down

#103

Post by PascLeRasc »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Github has a really great guide for getting started here: https://docs.github.com/en/github/authenticating-to-github/c...

It probably feels really unnecessary to newcomers though. I haven’t used Github Desktop in a long time but I feel like this would be perfect for a Git client to handle. It’ll fill in the “it’s just like Dropbox but for code” mental space.

Re: Git password authentication is shutting down

#104

Post by spicybright »

omnibrain wrote: post #56
pjc50 wrote: post #48

Earlier quoted context omitted.

The solution that everyone actually uses until they learn the unnecessary details is "take a backup of relevant files and blow away & redownload the repo".

Relevant xkcd: https://xkcd.com/1597/

The hover text is really good for this one too:

> If that doesn't fix it, git.txt contains the phone number of a friend of mine who understands git. Just wait through a few minutes of 'It's really pretty simple, just think of branches as...' and eventually you'll learn the commands that will fix everything.

Re: Git password authentication is shutting down

#105

Post by Wowfunhappy »

geofft wrote: post #85
Wowfunhappy wrote: post #66

Earlier quoted context omitted.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

I would guess that " in my password manager " immediately puts you into the minority of GitHub users. (Maybe not the minority of power users or high-profile software maintainers, to be fair, but they care about security for the site in general.) So maybe it didn't improve your security, if you were already letting your password manager generate distinct passwords, but it almost certainly improves the median user's se…

You're right, of course—I just resent being punished for other people's bad password choices. I wish they would turn it off by default (including changing existing accounts) and bury a checkbox deep in settings somewhere to turn it back on. Enabling the checkbox could even require that you change your Github password to something auto-generated!

Re: Git password authentication is shutting down

#106

Post by PascLeRasc »

Wowfunhappy wrote: post #66
chrisshroba wrote: post #61

Earlier quoted context omitted.

Just so folks know, you can still use personal access tokens, which basically work as per-application passwords. For someone just getting started with git, I'd recommend they go to https://github.com/settings/tokens , generate a token, and then they can just use that as their password when running `git clone`. This will certainly be a little more difficult for newcomers, and not very discoverable, but it is there.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

But you set permissions on it, right? I might be wrong but I believe the idea is that if you’re a maintainer on say Homebrew you can set up your VMs to not be able to commit towards that.

Re: Git password authentication is shutting down

#107

Post by drexlspivey »

wheybags wrote: post #20

When will we get repo-specific tokens? That's what I really want. As-is, I've just created extra special purpose github accounts, but that's a bad solution IMO.

You mean like deploy keys? https://docs.github.com/en/developers/overview/managing-depl...

Re: Git password authentication is shutting down

#108

Post by WorldMaker »

narraturgy wrote: post #46

Ok I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the d…

You can use a supporting Git Credential Manager (such as GCM Core: https://github.com/microsoft/Git-Credential-Manager-Core) to keep using HTTPS and login/password. Instead of typing in your username/password directly in the CLI, it pops up GitHub's login page where you input login/password and then does the dance for you to get an access token from that.

(Git for Windows default installs GCM Core. Some Linux distros do to. You may even already be using it. I think I've seen some confusion in comments here and elsewhere that they don't realize they are already typing in their username/password to a GCM dialog and that's going to keep working. This is about removing HTTPS Digest auth with direct password transmission over the wire.)

Re: Git password authentication is shutting down

#109

Post by WorldMaker »

jampekka wrote: post #90

So now I can't use git client on github repos anymore without carrying a device that has some impossible to memorize key or token on it? I hate it. I don't care much for the slight chance that someone gets into my github account. I care a lot more that now I have to jump hoops to get into my account myself. There's more to things than security.

You can use Access Tokens which are "application specific" passwords instead of SSH keys.

You can use a git credential manager such as GCM Core (https://github.com/microsoft/Git-Credential-Manager-Core) to automate the flow from username/password to access token. (It pops up a browser window where you login, retrieves and access token for you.)

Re: Git password authentication is shutting down

#110

Post by WorldMaker »

daxuak wrote: post #6

I have a noob question: what's the right way to use these tokens without password managers? I believe Github recommended assigning it as an environment variable in docs related to this deprecation, but isn't a (managed) server free to log the output of `echo $token`?

You can use a git credential manager that supports GitHub login flows. GCM Core is the big one: https://github.com/microsoft/Git-Credential-Manager-Core

(It lets you login to GitHub in a popup browser window and then manages the access token for you. Stores the access token in a machine credential cache for subsequent calls on that machine.)

Post reply on HN