Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

171–180 of 353 posts

Re: Git password authentication is shutting down

#171

Post by vtbassmatt »

gigel82 wrote: post #55
vtbassmatt wrote: post #35

Disclosure: I'm the Git Systems PM at GitHub. Opinions are my own and I wasn't directly involved with this effort. GCM Core is a really straightforward way to auth with GitHub and several other Git hosts. It comes with Git for Windows by default, can be installed with `brew` on macOS, and from a .deb on Linux. https://github.com/microsoft/Git-Credential-Manager-Core (it started under the Microsoft banner but is maint…

GCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change. I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate ev…

We recently added support for multiple identities but it's not complete (or seemingly documented, oops). I'll take a note to look into fixing and extending it.

Edit: but also, GCM Core has nothing to do with the user.email/user.name in .gitconfig. I have a similar problem where I want some commits written with my work email and others with my personal, and I always forget to check it when starting in a new repo. I push them both using a single GitHub identity, though, so your situation has an extra wrinkle.

Re: Git password authentication is shutting down

#172

Post by aloisklink »

Wowfunhappy wrote: post #66
chrisshroba wrote: post #61

Earlier quoted context omitted.

Just so folks know, you can still use personal access tokens, which basically work as per-application passwords. For someone just getting started with git, I'd recommend they go to https://github.com/settings/tokens , generate a token, and then they can just use that as their password when running `git clone`. This will certainly be a little more difficult for newcomers, and not very discoverable, but it is there.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

GitHub mentioned this in their blog-post: https://github.blog/2020-12-15-token-authentication-requirem...

> Tokens offer a number of security benefits over password-based authentication:

> - Unique – tokens are specific to GitHub and can be generated per use or per device

> - Revocable – tokens can can be individually revoked at any time without needing to update unaffected credentials

> - Limited – tokens can be narrowly scoped to allow only the access necessary for the use case

> - Random – tokens are not subject to the types of dictionary or brute force attempts that simpler passwords that you need to remember or enter regularly might be

I pretty much do the same thing, I just copy-and-paste a PAT from my password manager when I need it on VMs. The big benefit to us is that PATs are "limited", and mine only has Git repo access, so unlike my password, it can't:

- Delete repos

- Edit my GitHub organization

- Share my private repos with other users

- Add/remove SSH keys from my account

There's always the chance that a software you install on your VM would contain a keylogger (e.g. NPM/PyPI malicious libraries), so limiting the damage that your credentials can do is always a good thing.

Re: Git password authentication is shutting down

#173

Post by Animats »

spydum wrote: post #122
Animats wrote: post #79

Earlier quoted context omitted.

Setting up this authentication is a huge pain. First, the Github site lies to you. It tells me that, having previously generated a token, that token has never been used. It's been in use for months on one machine. Their web site and their repository system are not talking to each other. Then they want you to generate a new token, in the "new format". Then they refuse to generate a token valid for more than a year. Wi…

to be fair ms azure has a nice login experience for their cli tool (imho anyways).

Of course. Embrace, engulf, devour.

Re: Git password authentication is shutting down

#174

Post by redler »

francislavoie wrote: post #136
northwest65 wrote: post #118

Earlier quoted context omitted.

I've used GitExtensions from the start of my Git usage. I've never had to blow any of my repos away at any point. I also use things like Rebase without thinking about it, something which from what I've read on here is considered a slightly unusual/difficult task. Using GitExtensions means I can use Git as easily as any other tool, I never give it a second thought. I see the command line commands being executed, but n…

I used GitExtension for years, but then I switched to Linux some years ago, so I had to find an alternative. I used SourceTree for a while, but I hated the UX. I tried GitKraken when it first came out, but it had a lot of issues that didn't make it appropriate for my workflow. After a couple more years, GitKraken had improved enough that I was able to switch to it. I've been using it for maybe 4 or 5 years now.

“Tower” is quite good. Highly recommended.

Re: Git password authentication is shutting down

#176

Post by acomjean »

pjc50 wrote: post #48
BeefySwain wrote: post #39

Earlier quoted context omitted.

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

The solution that everyone actually uses until they learn the unnecessary details is "take a backup of relevant files and blow away & redownload the repo".

https://ohshitgit.com/

It has a few helpful hints.

Re: Git password authentication is shutting down

#177

Post by brundolf »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

The GitHub CLI could present an option to automatically call ssh-keygen and add the key to your account when you sign in from a device that doesn't have keys yet

Re: Git password authentication is shutting down

#178

Post by swiley »

doubleunplussed wrote: post #163

What's the recommended way to manage git clones on shared computers now? In the past, multiple people would use these computers, and would push and pull using their own github credentials. I'm talking lab computers in a research context, where there is a shared login to the computer, but where we use our own github credentials to access a shared repo we all have commit rights to. Now what are we supposed to do? I don…

In general shared computers should have seperate users, on Linux your user is just an su - away.

Re: Git password authentication is shutting down

#179

Post by buck4roo »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

For the love of humanity, pick a better tool to teach: Mercurial. Even teaching SVN would be easier. Both interop with github just fine.

Anything but git. Git was definitely not designed for ease-of-use.

Only Linus and friends need or use 90% of git's features.

Post reply on HN