git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Https password present in git output

From
Eervion <ervion@cryptolab.net>
Date
Jul 13, 2016, 17:26 UTC
Message-ID
<2908abd39c722c080ec37a987a79e32f@cryptolab.net>

Sometimes using ssh is not possible and saving https password in plain text to disk may be desireable (in case of encrypted disk it would be equivalent security with caching password in memory).

One possibility for this in git is to save remote in the https://username:password@domain.com/repo.git format. However, in this case every time you push or pull, the remote address, including the plain text password. That would introduce additional security issiues and is unreasonable?

Wouldn't it make sense to scrabble the password part in remote's url before printing it to output?

Next: Junio C Hamano
Message 1 of 6 in “Https password present in git output”
  1. ervionJul 13, 2016
  2. Junio C HamanoJul 13, 2016
  3. Junio C HamanoJul 13, 2016
  4. ervionJul 13, 2016
  5. Jeff KingJul 13, 2016
  6. Dennis KaarsemakerJul 13, 2016

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.