Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

181–190 of 353 posts

Re: Git password authentication is shutting down

#181

Post by aloisklink »

doubleunplussed wrote: post #163

What's the recommended way to manage git clones on shared computers now? In the past, multiple people would use these computers, and would push and pull using their own github credentials. I'm talking lab computers in a research context, where there is a shared login to the computer, but where we use our own github credentials to access a shared repo we all have commit rights to. Now what are we supposed to do? I don…

Honestly, in the case of a shared computer, I wouldn't recommend even using a password.

A lot of employers put monitoring software on their computers, and have keyloggers that can record your passwords. It's probably illegal for them to use the passwords, but I have heard horror stories where employers secretly log into their worker's social media accounts.

I'd recommending buying a U2F or FIDO2 security key, and creating a ed25519-sk or ecdsa-sk SSH key, see: https://github.blog/2021-05-10-security-keys-supported-ssh-g...

Basically, the SSH key is stored on the hardware key, and for every single git pull/git push you need to do, you must have the security key plugged in. If you're worried about forgetting the key and leaving it plugged in, you could add a password to the SSH key as well, so you're doubly protected.

Re: Git password authentication is shutting down

#182

Post by 3np »

sellyme wrote: post #155
young_unixer wrote: post #45

Earlier quoted context omitted.

Teaching git & Github to someone that doesn't know how to use a terminal is like teaching calculus to someone that doesn't know how to add. Of course you won't be able to do it in a couple of hours. Most people spend years learning the things that are required to understand how git works, or at least many months if you want to learn in a fast, intensive manner.

> Most people spend years learning the things that are required to understand how git works They don't need to know how git works, they need to know how to use it. Just like I don't need to know the details of an internal combustion engine to drive a car, someone who only does CSS work doesn't need to know how git works to push commits. A simple GUI interface suffices there. The problem is that the official Git GUI i…

There doesn’t exist any official Git GUI. Others already mentioned GitKraken, which I think is the most noob-friendly GUI while offering pretty complete functionality.

Re: Git password authentication is shutting down

#183

Post by notatoad »

nonameiguess wrote: post #113
Wowfunhappy wrote: post #66

Earlier quoted context omitted.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

Access tokens can practice least privilege and be scoped to a limited set of actions on a single repo. Your user password has whatever privileges your user has on every repo you've been given access to.

Not just whatever repo permissions your user has, critically your password has permissions to access your user account, which can do things like granting permissions to others, or changing your own security credentials.

Re: Git password authentication is shutting down

#184

Post by easygenes »

redler wrote: post #174
francislavoie wrote: post #136

Earlier quoted context omitted.

I used GitExtension for years, but then I switched to Linux some years ago, so I had to find an alternative. I used SourceTree for a while, but I hated the UX. I tried GitKraken when it first came out, but it had a lot of issues that didn't make it appropriate for my workflow. After a couple more years, GitKraken had improved enough that I was able to switch to it. I've been using it for maybe 4 or 5 years now.

“Tower” is quite good. Highly recommended.

MacOS and Windows only

Re: Git password authentication is shutting down

#185

Post by 3np »

peterburkimsher wrote: post #96
narraturgy wrote: post #46

Ok I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the d…

Thank you for being humble and describing the ways you use GitHub! I'm the same, and it's reassuring to know that I'm not the only one just using it as a free web host for personal projects. Until starting a new job in January 2021, I "knew git" to the extent of git pull, git add, git commit -m, and git push. For everything else I just made a copy of the repo. Now I've learned a little more about branches and merge r…

> regenerate a ton of SSH keys for every computer I own and link them to my account

You could do a single one per computer. You could even do a shared single one across all computers (it’s recommended against but not strictly worse than a shared password)

> disable 2FA because my phone number is in another country

Don’t use SMS for 2FA. Use TOTP (Google Authenticator or similar app. There are alternatives that let you sync) or U2F (hardware key)

Re: Git password authentication is shutting down

#187

Post by doubleunplussed »

swiley wrote: post #178
doubleunplussed wrote: post #163

What's the recommended way to manage git clones on shared computers now? In the past, multiple people would use these computers, and would push and pull using their own github credentials. I'm talking lab computers in a research context, where there is a shared login to the computer, but where we use our own github credentials to access a shared repo we all have commit rights to. Now what are we supposed to do? I don…

In general shared computers should have seperate users, on Linux your user is just an su - away.

In this case the environment is shared and so there is a single user account - this is for example a computer in a laboratory, connected to instruments.

Multiple user accounts would defeat the purpose of it being a shared computer. It's a shared computer because everyone is using it for the same thing.

Re: Git password authentication is shutting down

#188

Post by runnerup »

p1necone wrote: post #153
runnerup wrote: post #129

Earlier quoted context omitted.

> In the past, the solution was just not to use any of that. A bunch of files inside a random folder in your computer This is what my company does. Except we use git. Everyone just keeps their repo on their drive and there's no central "canonical" repository. Everyone has a personal folder in the main fileserver and they push frequently to their personal remote repo. Any time they send emails saying they've made a no…

What do you release from - just whatever personal repo has all the features you need? This is interesting because you're kinda using git as the fully distributed system that it's design allows for, which isn't that common.

> What do you release from - just whatever personal repo has all the features you need?

Yep - when we need to release we just kind of merge everything into a release, compile the firmware, validate it in house and then send it to our contract manufacturer in China. "Who" does that depends on whoever is free or most closely tied to that update.

Re: Git password authentication is shutting down

#189

Post by benatkin »

aloisklink wrote: post #172
Wowfunhappy wrote: post #66

Earlier quoted context omitted.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

GitHub mentioned this in their blog-post: https://github.blog/2020-12-15-token-authentication-requirem... > Tokens offer a number of security benefits over password-based authentication: > - Unique – tokens are specific to GitHub and can be generated per use or per device > - Revocable – tokens can can be individually revoked at any time without needing to update unaffected credentials > - Limited – tokens can be nar…

In many cases, none of these makes a difference at all. You may have 3 apps that need the most important permission (so what if it has unnecessary access to gists, when it has and needs full access to private repos) that you use on a single computer with a password manager. Either way, you need to reset the password/key if it becomes compromised.

Still, it's good to be in the habit of doing this, because sometimes you do need it.

Re: Git password authentication is shutting down

#190

Post by swiley »

doubleunplussed wrote: post #187
swiley wrote: post #178

Earlier quoted context omitted.

In general shared computers should have seperate users, on Linux your user is just an su - away.

In this case the environment is shared and so there is a single user account - this is for example a computer in a laboratory, connected to instruments. Multiple user accounts would defeat the purpose of it being a shared computer. It's a shared computer because everyone is using it for the same thing.

You can have a folder that's g+rwx and just give everyone different accounts for things like git. That's the reason these things exist.
Post reply on HN