Re: [http] Git error messages reveal password encoded in the URL
- From
Jacob Helwig <jacob.helwig@gmail.com>
- Date
- Jul 19, 2010, 21:16 UTC
- Message-ID
- <AANLkTilby7GWOuObh6W4z_caUG83O5A5Wh4Wb-JJnSdJ@mail.gmail.com>
- In-Reply-To
- <201007192310.56399.jnareb@gmail.com>
On Mon, Jul 19, 2010 at 14:10, Jakub Narebski <jnareb@gmail.com> wrote:
Show 18 quoted lines
> Dnia poniedziałek 19. lipca 2010 23:05, Jacob Helwig napisał: >> On Mon, Jul 19, 2010 at 14:02, Jakub Narebski <jnareb@gmail.com> wrote: >>> Ketan Padegaonkar <ketanpadegaonkar@gmail.com> writes: >>> >>>> We use http to serve our git repos, in order for git to not ask me a >>>> username/password everytime, >>> >>> Errr... WTF? Can't you configure SSH (use ssh-add, perhaps together with >>> tool such as keychain) to use public key based authentication? >>> >> >> I don't think SSH/ssh-agent/pubkey would actually help, given that >> it's a https URL. Unless I'm missing something here? > > I was referring to 'we use http [...] _in order_ for git to not ask me > a username/password everywhere'. I just noted that you can make git > not ask a username/password everywhere when using ssh:// URLs. >
Ah, I read it to mean "We use HTTP. I encode the user and password in the URL to prevent it from asking all the time", not "We use HTTP with an encoded user and password to prevent it from asking". If it's the latter, then you're definitely right: Using SSH + pubkey authentication is probably a _much_ better choice.