Re: [PATCH] Support username and password inside URL

From: Junio C Hamano <junkio@cox.net>
Date: Nov 20, 2005, 20:21 UTC
Message-ID: <7vwtj3xe72.fsf@assigned-by-dhcp.cox.net>
In-Reply-To: <873blriqh0.fsf@litku.valo.iki.fi>

Kalle Valo <Kalle.Valo@iki.fi> writes:

> Currently usage of curl was so that netrc was mandatory and passwords in URL
> weren't allowed. Change netrc to optional to make HTTP basic authentication
> with username and password in URL also work.

HTTP "basic"?  Let's at least say "digest" for starters ;-).

I am modestly against letting users use auth-embedding URLs, and fairly strongly against encouraging users to do so.

It is handy to have weak "authentication" in some situations. I am not ashamed to admit that I've used security-by-obscurity myself, when I sent an email to a friend, saying:

        Hi, I have some pictures I took during our last trip
        together, but due to their size I am not attaching them
        to this e-mail.  Please pick them up at:

	        http://members.cox.net/junkio/r0ZIEF/5S54m/

        Please drop me a note after picking them up, so that I
        can clean-up the directory.

Auth-embedding URLs are about as secure as the above URL, but it is worse because they may tempt you to reuse the same username password pair for other purposes later.

If you are using the password protected URL yourself, I'd imagine having them in your netrc would not be such a big deal, so I suspect your expected usage is not for yourself, but more like giving a temporary, even one-shot, access to others like the above example, and making it more convenient for them (even in that case, if it is not one-shot but for repeated use, I'd imagine it would not be such a big deal to ask them to do appropriate netrc). If that is what is going on here, then IMNSHO it would be better to make it clear that you are doing security-by-obscurity by not using username password pair, which makes you pretend that you are doing _some_ security.