From: Jacob Helwig Date: Mon, 19 Jul 2010 21:16:10 GMT Subject: Re: [http] Git error messages reveal password encoded in the URL Message-ID: In-Reply-To: <201007192310.56399.jnareb@gmail.com> On Mon, Jul 19, 2010 at 14:10, Jakub Narebski wrote: > Dnia poniedziałek 19. lipca 2010 23:05, Jacob Helwig napisał: >> On Mon, Jul 19, 2010 at 14:02, Jakub Narebski wrote: >>> Ketan Padegaonkar writes: >>> >>>> We use http to serve our git repos, in order for git to not ask me a >>>> username/password everytime, >>> >>> Errr... WTF?  Can't you configure SSH (use ssh-add, perhaps together with >>> tool such as keychain) to use public key based authentication? >>> >> >> I don't think SSH/ssh-agent/pubkey would actually help, given that >> it's a https URL.  Unless I'm missing something here? > > I was referring to 'we use http [...] _in order_ for git to not ask me > a username/password everywhere'.  I just noted that you can make git > not ask a username/password everywhere when using ssh:// URLs. > Ah, I read it to mean "We use HTTP. I encode the user and password in the URL to prevent it from asking all the time", not "We use HTTP with an encoded user and password to prevent it from asking". If it's the latter, then you're definitely right: Using SSH + pubkey authentication is probably a _much_ better choice.