Re: [http] Git error messages reveal password encoded in the URL

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Jul 19, 2010 at 14:10, Jakub Narebski <jnareb@xxxxxxxxx> wrote:
> Dnia poniedziałek 19. lipca 2010 23:05, Jacob Helwig napisał:
>> On Mon, Jul 19, 2010 at 14:02, Jakub Narebski <jnareb@xxxxxxxxx> wrote:
>>> Ketan Padegaonkar <ketanpadegaonkar@xxxxxxxxx> writes:
>>>
>>>> We use http to serve our git repos, in order for git to not ask me a
>>>> username/password everytime,
>>>
>>> Errr... WTF?  Can't you configure SSH (use ssh-add, perhaps together with
>>> tool such as keychain) to use public key based authentication?
>>>
>>
>> I don't think SSH/ssh-agent/pubkey would actually help, given that
>> it's a https URL.  Unless I'm missing something here?
>
> I was referring to 'we use http [...] _in order_ for git to not ask me
> a username/password everywhere'.  I just noted that you can make git
> not ask a username/password everywhere when using ssh:// URLs.
>

Ah, I read it to mean "We use HTTP.  I encode the user and password in
the URL to prevent it from asking all the time", not "We use HTTP with
an encoded user and password to prevent it from asking".  If it's the
latter, then you're definitely right: Using SSH + pubkey
authentication is probably a _much_ better choice.
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]