22 ms·
Git password authentication is shutting down
- wheybags 5y agoWhen will we get repo-specific tokens? That's what I really want. As-is, I've just created extra special purpose github accounts, but that's a bad solution IMO.
- rmorey 5y agoI'm guessing that if that's gonna happen (cmon, it's gotta) they view this migration is a pre-requisite
- rmorey 5y agoI'm guessing that if that's gonna happen (cmon, it's gotta) they view this migration as a pre-requisite
- Dylan16807 5y ago> they view this migration as a pre-requisite It's hard to picture how it could be.
- drexlspivey 5y agoYou mean like deploy keys? https://docs.github.com/en/developers/overview/managing-deploy-keys#deploy-keys https://docs.github.com/en/developers/overview/managing-depl...
- onionisafruit 5y agoCan you use deploy keys to auth with the api?
- wheybags 5y agoHuh, yeah I actually forgot about them, I have used them in the past. It would still be nice to be able to make repo-specific tokens though.
- orf 5y agoI wonder how many old, forgotten systems there are out there that pull from Github with a password. Brownouts are a smart way to try and weed those out, but there are going to be residual requests. I wonder how many.
- bastardoperator 5y agoLooks like they've been doing them for about a year, but stragglers are a guarantee!
- polote 5y agoThis is stupid, they only had to request passwords longer than 15 characters and that would have an even better effect. As web access will be also safer. They do it to prevent password reuse, but still allow passwords on the web. I don't get it
- X6S1x6Okd1st 5y agoYou have a much more flexible interface with the user on the web than via git push.
- eropple 5y agoThey do it to prevent passwords, which allow access to privileged things like account settings, from being stored (and thus subject to being accidentally leaked). It doesn't matter how long your password is if your password is in a text file with bad chmod permissions to people who shouldn't have it. An access token, at least, limits the blast radius.
- polote 5y agoAh get it. They don't want the password to login on github to be the same as the one you store on a text file. Makes sense. But it is still Baby-sitting
- nerdponx 5y agoIf this is babysitting, I never want to grow up.
- eropple 5y agoWhat you describe as "baby-sitting", I would call "encouraging users to fall into the pit of success." Many, many GitHub users are not professional software developers, and many more than that are not security-minded users at all. Small incremental improvements like this are a kind of defense in depth, and it is valuable.
- tclancy 5y agoAnd we have fifty years of software development history to prove we need this kind of babysitting. It’s a pain one time and then you realize it wasn’t hard to do and start doing a better practice out of habit.
- infogulch 5y agoI don't know how disruptive this will be, but there are many much better options to authenticate against github besides a password.
- alpb 5y agotldr Git SSH protocol will still support authentication via username:password but in this case, the "password" can no longer be your Github Account password, but it can be a Personal Access Token. So no need to panic if you've been using a build system or other tool that authenticates with username:token instead of a SSH key.
- justinator 5y agoTLDR? The article was three sentences!
- geerlingguy 5y agoWell, the comment was two :D
- nemetroid 5y agoThis change affects HTTPS access, not SSH.
- striking 5y agohttps://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/#workflows-affected https://github.blog/2020-12-15-token-authentication-requirem... Workflows affected: * Command line Git access * Desktop applications using Git (GitHub Desktop is unaffected) * Any apps/services that access Git repositories on GitHub.com directly using your password
- daxuak 5y agoI have a noob question: what's the right way to use these tokens without password managers? I believe Github recommended assigning it as an environment variable in docs related to this deprecation, but isn't a (managed) server free to log the output of `echo $token`?
- bastardoperator 5y agoUse SSH and GPG to authenticate and sign commits, it's easier and quicker. If you're doing something that needs a token use a GitHub App Token: https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps#about-github-apps https://docs.github.com/en/developers/apps/getting-started-w...
- geofft 5y agoIf there's a managed server you don't trust, it's unsafe to put anything that authenticates you to GitHub there, because it can (e.g.) modify the git command to push malicious code. For a semi-trusted machine (e.g., you want to "git push" to work-related OSS from your work desktop, but you don't want your work HR/IT departments to have full access to your GitHub account if they decide they want it), make a new SSH key and configure it as a read/write deploy key for that one repo. This workflow is primarily intended for automation, but it's reasonable for this sort of interactive use as well. https://docs.github.com/en/developers/overview/managing-deploy-keys#deploy-keys https://docs.github.com/en/developers/overview/managing-depl...
- eropple 5y agoOne probably has to assume at least some level of control of any system where there's access to secrets where they're necessary for production processes. But if you aren't confident of it, then at least that token only has access to a repository, and can't be exfiltrated to let somebody log in and really mess with your user account or your organization. (All that said: I'd recommend a single-use, minimally privileged SSH key over an access token, just because that workflow's what you should be using on a desktop too.)
- WorldMaker 5y agoYou can use a git credential manager that supports GitHub login flows. GCM Core is the big one: https://github.com/microsoft/Git-Credential-Manager-Core https://github.com/microsoft/Git-Credential-Manager-Core (It lets you login to GitHub in a popup browser window and then manages the access token for you. Stores the access token in a machine credential cache for subsequent calls on that machine.)
- ushakov 5y agoEmbrace. Extend. Extinguish
- jrockway 5y agoPasswords are probably one of the worst things to happen to our field as a whole (phishing, password managers, etc. are the results of their ubiquity), so efforts to remove them are probably not part of some Microsoft plan to kill open source. This change is a good thing.
- HeckFeck 5y agoIndeed. I wish there was something like a token or key that was as ubiquitous as passwords. Though from a developer POV I can certainly see why passwords are so attractive: take a word, hash it, compare hash on subsequent logins. The alternatives are tricky, but not I suspect impossible, to do in a decentralised manner. I've often pondered that something like PGP servers with revocation certificates, but adapted to logins would be near the realm of a solution.
- toiletaccount 5y agoDo you want to be the one to explain PGP and revcerts to somebody who has used the same password for everything their whole life?
- HeckFeck 5y agoThat's why I said 'something like'. An extension of the idea adapted for wider use. I'm certain such a person uses TCP/IP every day and doesn't need it explained. Yet twenty years ago, some knowledge of IP addresses and subnet masks etc was necessary to get connected.
- jrockway 5y agoYeah, I think WebAuthn is fairly seamless. Ordinary users do not have to worry about certificates or anything. They just log in with their face, fingerprint, or a computer-local PIN. I think what prevents wider adoption of WebAuthn is the fear that users are going to lose their phone and not have a backup authenticator. But, people probably lose their phone less often than they forget passwords, so I doubt it changes the support burden much.
- hiimshort 5y agoI'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces. Adding on ssh-keygen, key management adds even more friction. It's certainly a difficult problem. How can we offer a more gentle learning curve for budding developers while still requiring "real" projects to use best practices for security and development?
- mynameisvlad 5y agoIs there a reason one of the many git tutorials online wasn't good enough? https://docs.github.com/en/get-started/quickstart/set-up-git https://docs.github.com/en/get-started/quickstart/set-up-git https://www.atlassian.com/git/tutorials https://www.atlassian.com/git/tutorials This one's always fun: https://learngitbranching.js.org/ https://learngitbranching.js.org/ https://www.tutorialspoint.com/git/index.htm https://www.tutorialspoint.com/git/index.htm
- hiimshort 5y agoWe're taking a 1:1 approach, but most of the time I take issue with the language used in many guides. The linked guides are good examples, they contain a whole load of terms and buzzwords you don't need to know as a beginner.
- AlexandrB 5y agoLet's look at the tutorial for caching git credentials, which is referenced in your first link: (https://docs.github.com/en/get-started/getting-started-with-git/caching-your-github-credentials-in-git https://docs.github.com/en/get-started/getting-started-with-...). It walks you through installing a "cask" using "brew". It doesn't mention how to install homebrew but instead directs you to the homebrew homepage which shows the output of a curl command being fed to `bash -c`. Something that's both bad practice and unintelligible unless you're quite familiar with Unix shells. If everything works as intended, you're good to go! But if anything goes wrong, or you have to update the "cask" in the future you're left with little to no context about what you just did. For someone unfamiliar with Unix shell commands, homebrew, curl, etc. this is a quagmire that can take days to unravel without someone there to help them.
- Androider 5y agoHopefully they'll enhance the other authentication methods. I was quite surprised how complicated yet insecure the GitHub Actions and personal access token mechanisms are just last week. GitHub Actions tokens are scoped to the single repo they operate in, so for anything that you need covering any cross-repository or org access the official docs immediately tell you to just use a PAT instead. But PATs have no repository scoping whatsoever, it's all or nothing. So although both PATs and GHA Tokens have these complex scope requests, it's completely missing the most basic use cases in my opinion, like creating a PR in repo X, allow installing a package from GitHub Packages in repo Y, check out code from repo Z etc. You either go full mono-repo for everything, or you use PATs for everything with no repository boundaries at all, yikes.
- Operyl 5y agoYeah .. it's not great. Creating a machine user is really the only way to do it right now :(.
- niffydroid 5y agoThe scoping of pat currently are terrible. If I want a read only access token, the user needs to be read only, if I went write, user needs write permissions. This means I need 2 users
- vtbassmatt 5y agoDisclosure: I'm the Git Systems PM at GitHub. Opinions are my own and I wasn't directly involved with this effort. GCM Core is a really straightforward way to auth with GitHub and several other Git hosts. It comes with Git for Windows by default, can be installed with `brew` on macOS, and from a .deb on Linux. https://github.com/microsoft/Git-Credential-Manager-Core https://github.com/microsoft/Git-Credential-Manager-Core (it started under the Microsoft banner but is maintained by GitHub employees now).
- gigel82 5y agoGCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change. I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate every time and manually check each clone's .git/config.
- chipotle_coyote 5y agoCan't you still use https with this? You use the personal account token for the specific account to log in as the "password". I've been doing this recently with two GitHub accounts. In my ~/.gitconfig file, I've included [credential "https://github.com"] useHttpPath = true Which means that the first time -- and only the first time -- I try to do something with a GitHub repo that requires authentication, I'll be asked for the username and password (token), and I make sure to use the right one. :) At that point things stay set.
- lentil 5y agoWhile this probably doesn’t completely solve your problem, have you tried using conditional includes in your .gitconfig? I’ve been using that to ensure that anything under ~/work uses my work email for user.email, but anything under ~/projects uses my personal email. It’s quite handy. https://git-scm.com/docs/git-config#_conditional_includes https://git-scm.com/docs/git-config#_conditional_includes
- narraturgy 5y agoOk I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the default suggestion GitHub provides you when you add a new repo to your profile so that you can connect your local git repo to it. For hosting my trivial personal projects it seems so silly to have to go onto github's web interface and click through a bunch of their ui to build a personal passkey(which is just a password with a different name afaict). Am I just not the intended audience for the change or am I missing something crucial that doesn't make this seem like a bunch of extra effort for no meaningful change?
- epage 5y agoI was in the same boat until recently. There have even been a couple of projects I got invited to that I never could join because of this (since multi-factor doesn't work with terminal username/password). I've tried setting up SSH keys many times and have somehow failed many times. The UX for security stuff just isn't there. I finally have gotten a workflow sort-of figured out and documented to remind myself in the future.
- amiga-workbench 5y agoKey based auth is much more resistant to phishing. Its just one command to have openssh generate a key pair on your computer, and you're done. Password auth in general cannot go away fast enough.
- spondyl 5y agoFor any Githubbers reading, my coworker was apparently affected by a brownout window and changed to using a personal access token. He didn't know it at the time but I just mentioned the period and it lines up with when had issues with his authentication. Seems like a success if you ask me!
- spondyl 5y agoFor any Githubbers reading, my coworker was apparently affected by a brownout window and changed to using a personal access token. He didn't know it at the time but I just mentioned the period and it lines up with when had issues with his authentication. Seems like the brownout was a success in our case!
- cryvate1284 5y agoSimilar here, though we did narrow it down to the cause/brownout at the time.
- ramesh31 5y agoI feel a great disturbance in the force... As if millions of CI jobs suddenly cried out in terror, and were suddenly silenced.
- deleted 5y ago[deleted]
- a-dub 5y agoit seems about the only use case for passwords was cloning a private repository in an environment where you don't want keep your keys. that said, any environment where you don't want to keep your keys isn't necessarily a place you want to be typing in your account password anyhow. human typable one time passwords for this purpose could be cool. although it's a pretty rare use case.
- itake 5y agoSeems odd Github would announce the cutoff time in PST when the USA is in PDT.
- CoryAlexMartin 5y agoThis is a very common mistake. Lots of people are unaware that they're supposed to change acronyms depending on whether or not daylight savings time is in effect.
- SamReidHughes 5y agoPST means Pacific Summer Time in the summer.
- jampekka 5y agoSo now I can't use git client on github repos anymore without carrying a device that has some impossible to memorize key or token on it? I hate it. I don't care much for the slight chance that someone gets into my github account. I care a lot more that now I have to jump hoops to get into my account myself. There's more to things than security.
- WorldMaker 5y agoYou can use Access Tokens which are "application specific" passwords instead of SSH keys. You can use a git credential manager such as GCM Core (https://github.com/microsoft/Git-Credential-Manager-Core https://github.com/microsoft/Git-Credential-Manager-Core) to automate the flow from username/password to access token. (It pops up a browser window where you login, retrieves and access token for you.)
- jampekka 5y agoSounds a lot like a hoop. With password I can use any device with git installed to pull and push from/to github repos. Now I'd need a hack like this on top. I prefer less tools to more tools. Probably a losing battle given how the field is developing.
- WorldMaker 5y agoGCM Core is installed out of the box with official git installer on Windows. Several Linux distributions at this point include it as well. On macOS it is a simple brew install away. git itself was built as an agglomeration of multiple tools bundled together and GCM Core is right on the borderline of a tool always included in the git distribution anyway on some platforms and needs to be installed on others. It's likely to always be in that "weird border space" because it requires a web browser and there isn't a pure command line equivalent.
- jampekka 5y agoSo if I SSH into a machine, no management for me. And it doesn't seem to be in APT at least in Debian unstable. And even if it is, it is still another tool, subject to breakage and with heavy dependencies. Also not very eager to install some .NET runtime just to have some hack to pop up a browser. Sorry, but I still hate it. I want less software, not more.
- DangitBobby 5y agoFor those of you who are saying you don't really "know" git, your VCS will be so so much less stressful if you take a day or so to learn it! I can't recommend this site enough for familiarity with the basics: https://learngitbranching.js.org/ https://learngitbranching.js.org/
- GuB-42 5y agoThe news is not actually about git, it is about GitHub. Maybe they should make it more explicit in the title. Git still supports password authentication, as well as many other protocols. GitHub chose to restrict which protocols and authentication schemes are allowed on its platform. But obviously, learning about the tools you are using is always a good idea. My preferred "tutorial" is this one: https://codewords.recurse.com/issues/two/git-from-the-inside-out https://codewords.recurse.com/issues/two/git-from-the-inside... It is more advanced than the usual introductions but it demystifies most of the git concepts.
- DangitBobby 5y agoI know, but a lot of discussion ended up being about git with people saying they didn't "get" it (heh), hence the link.
- javajosh 5y agoHot tip for IntelliJ users: add your github account to the IDE (in project settings) and the IDE will use an OAuth token for git access on that account. (I think the way it's structured is that Jetbrains is the OAuth provider, and Github is the relying party, which implies that you need to make sure your Jetbrains account is secure. It also means that if you want the best security you'll stick with the tried-and-true private-key-in-.ssh-public-key-on-remote solution)
- qwerty456127 5y agoVery sad. An unfriendly move needlessly forcing unnecessary complexity. People should be able to decide this for themselves.
- francislavoie 5y agoThat's not how security works. Give users the easy option, and they'll take it. For things to be secure by default, you need to disallow or _heavily_ discourage all potentially insecure options.
- CamperBob2 5y agoBlindly assuming that everybody has the same threat model is also not how security works.
- Cadwhisker 5y agoI use TortoiseGit under Windows. It took me 3 days (on and off) to figure out how to push code to my repositories again. The amount of misleadng and confusing information on the internet is extraordinary. Signed: a developer with well over a decade of experience in version control, *nix, Windows, crypto, etc.
- voltagex_ 5y agoI'd be really interested in hearing about your struggles - this tells me there's something really wrong with the tutorials you were reading (through no fault of your own).
- Cadwhisker 5y agoIt was a month ago and I didn't note down all my attempts. It went something like: Pushes were not working. I re-entered my password a few times, checked other config settings a few times before Googling the Git error message, which led me to find that GitHub's security policy was changing. I tried an SSH login (fail), switched to trying locally generated SSH keys. Used PuTTY's "puttygen.exe" to make an SSH key. Did that, then found it was a newer format that Tortoise could not handle. Used TortoiseGit's copy of "puttygen.exe". Did this a few times as GitHub wouldn't accept the format that my key was in. Gave up on GUI key generation, tried command-line and failed a few more times. I think I looked at personal access tokens at some point. Went back to GUI SSH file creation, and managed to upload my puttygen SSH key by copy/pasting from part of the dialog box that I hadn't tried before. Used GitHub's "git@github.com:<username>/repo" syntax to get a fresh clone of my repo. Finally I realised that I needed to use the github URL syntax combined with "Load Putty Key" ticked and pointing to my private key I'm still not sure if it's the right way or the best way, but it worked, so I stopped looking.
- voltagex_ 5y agoI don't think I can recommend anyone use PuTTY on Windows anymore, partly because of issues like this. It might be that TortoiseGit is old, but ssh.exe should be available on Windows 10 now.
- ikiris 5y agogithub auth is literally so broken that it claims chrome cant even support fido security keys, and they think SMS is a secure alternate path.
- aabbcc1241 5y agoIf password authentication is insecure, why don't most website authenticate with private key? Because most people want to keep it simple.
- doubleunplussed 5y agoWhat's the recommended way to manage git clones on shared computers now? In the past, multiple people would use these computers, and would push and pull using their own github credentials. I'm talking lab computers in a research context, where there is a shared login to the computer, but where we use our own github credentials to access a shared repo we all have commit rights to. Now what are we supposed to do? I don't want to put my ssh key, or an access token or whatever, on a shared computer. My colleagues using that computer should not be able to access my other github repos. I should be entering a password, something I can keep in my head.
- efnx 5y agoYou can use an access token (and not store it), or you can use one unique ssh key per machine. But yeah, it looks like for your use case this is not a great change.
- devman0 5y agoYou can wrap an ssh key with a password.
- swiley 5y agoIn general shared computers should have seperate users, on Linux your user is just an su - away.
- doubleunplussed 5y agoIn this case the environment is shared and so there is a single user account - this is for example a computer in a laboratory, connected to instruments. Multiple user accounts would defeat the purpose of it being a shared computer. It's a shared computer because everyone is using it for the same thing.
- swiley 5y agoYou can have a folder that's g+rwx and just give everyone different accounts for things like git. That's the reason these things exist.
- rubyist5eva 5y agoYou can use git with github with password authentication?
- jim-jim-jim 5y agoI really couldn't give less of a fuck if my smattering of half-finished learning projects were lacking """best practices""" in security. So sick of this stupid nerd bullshit sometimes.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- DangitBobby 5y agoAnyone else notice that GitHub recently removed the sample code for cloning with SSH?
- bombela 5y agoYep. I feel it's been a few weeks at least.
- shikoba 5y agoI deleted my github account when M$ took over so I can't check. You're logged, you have declared a SSH key but they still don't provide the small code line to clone using SSH?
- DangitBobby 5y agoThat's a good question. It seems to only happen if I'm not logged in. It could very well be because it doesn't know if I have an SSH key. Not that it really matters for a public repo.
- paul_h 5y agohttps://www.sparkleshare.org/ https://www.sparkleshare.org/ reminder for non-coding usages of git. Though of course this does't solve the user/passwd going away problem itself
- wink 5y agoI've used this for years on an account I only occasionally commit something once or twice a year, from different computers (but still too complicated to use the online editor). It's easy to forget that not every use case is a regular developer who has their dev environment set up. That said, for me it wasn't a big deal just switching to ssh keys like with my main account.
- RedFoxEdtech 5y agonice
- collaborative 5y agoFor some reason I cant figure out the token auth on Netbeans
- funcDropShadow 5y agoThis should reflect in the title that it is about GitHub, not about git.
- capableweb 5y agoIt's pretty obvious. Git itself doesn't have password authentication (I mean locally/repo-level, only on the transport level) and it can't be "shut down", only "removed" or "unsupported"/"deprecated". Also, you can see the domain right next to the submission title.
- framecowbird 5y agoThey are temping fate by releasing this on Friday 13th :)
- jokoon 5y agoI'm using git-bash on windows, I've created my key pair and set it up on my github account. What is the correct way to automatically use when pull/pushing?
- joshghent 5y agoThis is a good thing, but I've got an awkward "chicken and egg" situation. My dotfiles are stored on GitHub, which I pull using username/password. The scripts then sets up and adds a new SSH key to GitHub.
- AkshitGarg 5y agoYou can still use a PAT (personal access token) to authenticate via HTTPS. Instead of sending username and password, you send username and the PAT token for authentication
- yashasolutions 5y agoWhile it is a clear win for security, git password auth is still part of the regular api that git provide. I get that github is big enough to set their own standard, but oftentime, when other big companies did that (Microsoft, Google, etc.) it ended up being detrimental to the global ecosystem. Of course it doesn't have to be here...
- Proven 5y agoSo fucking annoying
- ok123456 5y agoOh great. More security theater. This should be a per repository setting. Not system wide! If someone has a "threat model" where "passwords are bad" then fine. Force users interacting with that particular repository to deal with this security theater of making tokens which have the same power as the account that authorized them. I guess they have better granularity, but in practice anything more complicated that Unix permissions is a total disaster and just leads to people not understanding what the different levels actually mean. It shouldn't be imposed top-down on every user.
- jatone 5y agothey just don't want to maintain that code path anymore for whatever reason. its their product, their choice. you're just along for the ride.
- WhyNotHugo 5y agoAre there any use-cases where this would have been preferable to plain key-based ssh auth?
- deleted 5y ago[deleted]