7 ms·

Git: The Stupid Password Store

73 points by thcipriani 2y ago

maratc 2y ago
> With git over ssh, you use your keys. Why use git over https then?
- frizlab 2y ago
  I also have a hard time understanding why would people use https to clone a repo when ssh is there and so much more convenient…
  - maratc 2y ago
    Also, an existing repo that has been cloned over https can be converted to use ssh: ~ $ git remote -v origin https://github.com/mycompany/myproject.git (fetch) origin https://github.com/mycompany/myproject.git (push) ~ $ git remote remove origin ~ $ git remote add origin git@github.com:mycompany/myproject.git ~ $ git remote -v origin git@github.com:mycompany/myproject.git (fetch) origin git@github.com:mycompany/myproject.git (push)
    - frizlab 2y ago
      Or git remote set-url origin git@github.com:... Or using URL replacements in git config.
      - seodisparate 2y ago
        Or using .ssh/config since entries in there act like hostnames: # ~/.ssh/config Host github_ssh HostName github.com User git IdentityFile ~/.ssh/my_github_key > git remote add github github_ssh:Username/RepoName.git This has worked reliably for me for quite a while now.
        fisian 2y ago
        However, this doesn't work well with git submodules, because then everyone cloning the repo must recreate this config. (Just something to be aware of.)
        3np 2y ago
        It works fine if coupled with URL replacement. The custom hostname will be replaced transparantly for you and won't need to make it into gitmodules. # ~/.config/git/config # Only for single user/org [url "git@github_ssh:foo"] insteadOf = "git@github.com:foo" # all the things [url "git@github_ssh"] insteadOf = "git@github.com" Similar pattern if you want to force-use ssh instead of https or vice-versa.
  - hamandcheese 2y ago
    You can't clone a public repo over SSH without having authenticated keys set up. Somewhat annoying on servers that you forgot/don't want to use agent forwarding on.
    - ninjin 2y ago
      You can set up anonymous SSH access. It is just that for some reason the big "hubs" do not do so. See for example the instructions that come with gotsh(1): https://www.gameoftrees.org/gotsh.1.html https://www.gameoftrees.org/gotsh.1.html Obviously not a good idea for repositories that you want to keep private. But it is odd to me how rare it is for public repositories.
    - JackSlateur 2y ago
      Why ? Openbar readonly ssh servers exists. Also, cloning private repo via http is a pain, when MFA is involved
  - Ferret7446 2y ago
    HTTP has many advantages (and SSH has disadvantages) as detailed in https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protoco.... Briefly, HTTP is more flexible. For authentication, you could use passwords or OAuth.
    - frizlab 2y ago
      From your link, literally, both HTTPS and SSH have pros and cons! You make it look like SSH only has cons and HTTPS only has pros; that’s borderline dishonest.
  - akdor1154 2y ago
    I also used to think this, then I realised https has far better performance, particularly for high latency connections. A big repo clone from Github to here in Australia takes about half the time over https when compared with ssh. I'm not sure if github has region-located repos.
    - bin_bash 2y ago
      does it? I've used both quite a bit and ssh certainly "feels" faster to me (with multiplexing)
    - MaxBarraclough 2y ago
      It's possible that's an issue with GitHub, rather than anything inherent to the protocols. Somewhat related: SourceHut blog post on them optimising Git operations over SSH: https://sourcehut.org/blog/2019-11-22-what-happens-on-git-push/ https://sourcehut.org/blog/2019-11-22-what-happens-on-git-pu...
  - szszrk 2y ago
    In corporate networks having direct access to public hosts (or even internal ones) with anything other than https is a challenge.
  - MaxBarraclough 2y ago
    I'd generally recommend HTTPS, simply because most developers cannot be trusted to manually verify SSH public keys/fingerprints. Most will blindly approve whatever fingerprint they are shown, opening the door to man-in-the-middle attacks. This isn't just an issue during initial set-up. If the Git host rotates their keys, it will need the client to accept the new keys. If your developers are sloppy and unthinkingly approve the new fingerprint, that means they're vulnerable to a MitM attack at any moment; presumably they'd unthinkingly approve an attacker's fingerprint too. With HTTPS, you inherit the web's CA model, and it's pretty much secure-by-default.
    - mariocesar 2y ago
      Respectfully, it seems that your actual problem is that you work with developers who can't be trusted to manually verify SSH public keys/fingerprints, not that SSH is complicated. Defaulting to HTTPS just because it is easier for them feels like a no-solution, but I could be generalizing. Maybe you are talking about developers in training or L1 levels.
      - dangsux 2y ago
        [flagged]
        MaxBarraclough 2y ago
        > There is a reason github’s ui defaults to clone over ssh which is missed by you. I think you meant HTTPS here?
        dangsux 2y ago
        [dead]
        frizlab 2y ago
        Acknowledging I’m not a casual computer user, I personally find https being the unnecessary friction (must [learn to +] setup setting user/password for https, username/password do not work for https because 2FA, etc.). With ssh I upload my key and I’m done.
  - Daedren 2y ago
    Plenty of places don't support Git LFS over SSH
- prepend 2y ago
  My network blocks outbound ssh, so I use https.
  - mariocesar 2y ago
    I had the same issue, but you can clone using SSH over HTTPS with GitHub. Like this: git clone ssh://git@ssh.github.com:443/rtyley/small-test-repo.git instead of: git clone git@github.com:rtyley/small-test-repo.git
    - crtasm 2y ago
      Is that using HTTPS? It looks like regular ssh running on port 443.
      - NegativeK 2y ago
        Also, if you're on a corporate network and start pushing ssh through 443, a competent security team should check in on you to make sure things are okay.
        mariocesar 2y ago
        Yes, if you have audits, most probably they will look for protocols traffic rather than just ports open
      - mariocesar 2y ago
        The protocol is SSH, but the port is 443. Yes, it's not HTTPS, it's just SSH on a different port than 22.
  - gchamonlive 2y ago
    Is that by design or accident? I couldn't imagine living without ssh.
    - prepend 2y ago
rswail 2y ago
AWS CodeCommit (just been deprecated btw), has a credential helper that allows you to use IAM role/policies instead of SSH keys.
zeitlupe 2y ago
hunter2 still gives me a smile
84777957749 2y ago
[flagged]
tialaramex 2y ago
If a system relies on "passwords" (or any similar shared secret scheme) it clearly doesn't really care about security. Yes that includes your bank. If it doesn't require shared secrets, this isn't scary, the git mechanism works just fine.
- _ZeD_ 2y ago
  > If a system relies on "passwords" (or any similar shared secret scheme) it clearly doesn't really care about security. that's ... one of the dumbest thing I've ever read
  - eddieroger 2y ago
    Security is easy if you don't care about usability.
    - tialaramex 2y ago
      What's funniest without any doubt is that passwords and similar shared secret systems have worse usability and worse security. They're a classic "Worse is better" like C where their principle advantage is simplicity of implementation. Sure, they're terrible, but look easy it was!
  - tialaramex 2y ago
    I know right? Stupid facts, going around disagreeing with your intuitions. How can shared secrets be a bad idea? I mean, it was considered pretty good a thousand years ago, can technology really have improved since then? [Hint: yes, drastically]
SURA 2y ago
tar -zxvf git-2.46.0.tar.gz cd git-2.46.0 make configure ./configure --prefix=/usr/local make sudo make install rm -rf /usr/local/libexec/git-core/git-credential-cache*

73 points by thcipriani 2y ago

maratc 2y ago

> With git over ssh, you use your keys. Why use git over https then?

frizlab 2y ago
I also have a hard time understanding why would people use https to clone a repo when ssh is there and so much more convenient…
- maratc 2y ago
  Also, an existing repo that has been cloned over https can be converted to use ssh: ~ $ git remote -v origin https://github.com/mycompany/myproject.git (fetch) origin https://github.com/mycompany/myproject.git (push) ~ $ git remote remove origin ~ $ git remote add origin git@github.com:mycompany/myproject.git ~ $ git remote -v origin git@github.com:mycompany/myproject.git (fetch) origin git@github.com:mycompany/myproject.git (push)
  - frizlab 2y ago
    Or git remote set-url origin git@github.com:... Or using URL replacements in git config.
    - seodisparate 2y ago
      Or using .ssh/config since entries in there act like hostnames: # ~/.ssh/config Host github_ssh HostName github.com User git IdentityFile ~/.ssh/my_github_key > git remote add github github_ssh:Username/RepoName.git This has worked reliably for me for quite a while now.
      - fisian 2y ago
        However, this doesn't work well with git submodules, because then everyone cloning the repo must recreate this config. (Just something to be aware of.)
        3np 2y ago
        It works fine if coupled with URL replacement. The custom hostname will be replaced transparantly for you and won't need to make it into gitmodules. # ~/.config/git/config # Only for single user/org [url "git@github_ssh:foo"] insteadOf = "git@github.com:foo" # all the things [url "git@github_ssh"] insteadOf = "git@github.com" Similar pattern if you want to force-use ssh instead of https or vice-versa.
- hamandcheese 2y ago
  You can't clone a public repo over SSH without having authenticated keys set up. Somewhat annoying on servers that you forgot/don't want to use agent forwarding on.
  - ninjin 2y ago
    You can set up anonymous SSH access. It is just that for some reason the big "hubs" do not do so. See for example the instructions that come with gotsh(1): https://www.gameoftrees.org/gotsh.1.html https://www.gameoftrees.org/gotsh.1.html Obviously not a good idea for repositories that you want to keep private. But it is odd to me how rare it is for public repositories.
  - JackSlateur 2y ago
    Why ? Openbar readonly ssh servers exists. Also, cloning private repo via http is a pain, when MFA is involved
- Ferret7446 2y ago
  HTTP has many advantages (and SSH has disadvantages) as detailed in https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protoco.... Briefly, HTTP is more flexible. For authentication, you could use passwords or OAuth.
  - frizlab 2y ago
    From your link, literally, both HTTPS and SSH have pros and cons! You make it look like SSH only has cons and HTTPS only has pros; that’s borderline dishonest.
- akdor1154 2y ago
  I also used to think this, then I realised https has far better performance, particularly for high latency connections. A big repo clone from Github to here in Australia takes about half the time over https when compared with ssh. I'm not sure if github has region-located repos.
  - bin_bash 2y ago
    does it? I've used both quite a bit and ssh certainly "feels" faster to me (with multiplexing)
  - MaxBarraclough 2y ago
    It's possible that's an issue with GitHub, rather than anything inherent to the protocols. Somewhat related: SourceHut blog post on them optimising Git operations over SSH: https://sourcehut.org/blog/2019-11-22-what-happens-on-git-push/ https://sourcehut.org/blog/2019-11-22-what-happens-on-git-pu...
- szszrk 2y ago
  In corporate networks having direct access to public hosts (or even internal ones) with anything other than https is a challenge.
- MaxBarraclough 2y ago
  I'd generally recommend HTTPS, simply because most developers cannot be trusted to manually verify SSH public keys/fingerprints. Most will blindly approve whatever fingerprint they are shown, opening the door to man-in-the-middle attacks. This isn't just an issue during initial set-up. If the Git host rotates their keys, it will need the client to accept the new keys. If your developers are sloppy and unthinkingly approve the new fingerprint, that means they're vulnerable to a MitM attack at any moment; presumably they'd unthinkingly approve an attacker's fingerprint too. With HTTPS, you inherit the web's CA model, and it's pretty much secure-by-default.
  - mariocesar 2y ago
    Respectfully, it seems that your actual problem is that you work with developers who can't be trusted to manually verify SSH public keys/fingerprints, not that SSH is complicated. Defaulting to HTTPS just because it is easier for them feels like a no-solution, but I could be generalizing. Maybe you are talking about developers in training or L1 levels.
    - dangsux 2y ago
      [flagged]
      - MaxBarraclough 2y ago
        > There is a reason github’s ui defaults to clone over ssh which is missed by you. I think you meant HTTPS here?
        dangsux 2y ago
        [dead]
      - frizlab 2y ago
        Acknowledging I’m not a casual computer user, I personally find https being the unnecessary friction (must [learn to +] setup setting user/password for https, username/password do not work for https because 2FA, etc.). With ssh I upload my key and I’m done.
- Daedren 2y ago
  Plenty of places don't support Git LFS over SSH
prepend 2y ago
My network blocks outbound ssh, so I use https.
- mariocesar 2y ago
  I had the same issue, but you can clone using SSH over HTTPS with GitHub. Like this: git clone ssh://git@ssh.github.com:443/rtyley/small-test-repo.git instead of: git clone git@github.com:rtyley/small-test-repo.git
  - crtasm 2y ago
    Is that using HTTPS? It looks like regular ssh running on port 443.
    - NegativeK 2y ago
      Also, if you're on a corporate network and start pushing ssh through 443, a competent security team should check in on you to make sure things are okay.
      - mariocesar 2y ago
        Yes, if you have audits, most probably they will look for protocols traffic rather than just ports open
    - mariocesar 2y ago
      The protocol is SSH, but the port is 443. Yes, it's not HTTPS, it's just SSH on a different port than 22.
- gchamonlive 2y ago
  Is that by design or accident? I couldn't imagine living without ssh.
  - prepend 2y ago

rswail 2y ago

AWS CodeCommit (just been deprecated btw), has a credential helper that allows you to use IAM role/policies instead of SSH keys.

zeitlupe 2y ago

hunter2 still gives me a smile

84777957749 2y ago

[flagged]

tialaramex 2y ago

If a system relies on "passwords" (or any similar shared secret scheme) it clearly doesn't really care about security. Yes that includes your bank. If it doesn't require shared secrets, this isn't scary, the git mechanism works just fine.

_ZeD_ 2y ago
> If a system relies on "passwords" (or any similar shared secret scheme) it clearly doesn't really care about security. that's ... one of the dumbest thing I've ever read
- eddieroger 2y ago
  Security is easy if you don't care about usability.
  - tialaramex 2y ago
    What's funniest without any doubt is that passwords and similar shared secret systems have worse usability and worse security. They're a classic "Worse is better" like C where their principle advantage is simplicity of implementation. Sure, they're terrible, but look easy it was!
- tialaramex 2y ago
  I know right? Stupid facts, going around disagreeing with your intuitions. How can shared secrets be a bad idea? I mean, it was considered pretty good a thousand years ago, can technology really have improved since then? [Hint: yes, drastically]

SURA 2y ago

tar -zxvf git-2.46.0.tar.gz cd git-2.46.0 make configure ./configure --prefix=/usr/local make sudo make install rm -rf /usr/local/libexec/git-core/git-credential-cache*