3 ms·
What leads to the secret being stored in git's config file like that? None of my repositories have that, the remote URLs all just say "git@github.com:foo/bar.gi
by CGamesPlay 11mo ago
What leads to the secret being stored in git's config file like that? None of my repositories have that, the remote URLs all just say "git@github.com:foo/bar.git".
- aewens 11mo agoThe way Git computes diffs is by more or less storing all the source code in the .git directory as objects. At first glance it looks like a bunch of hashes, but tools can pull out source code from the objects tracked within the .git directory. Not least of which, the remote URL points to their username on GitHub and the author for commits can give you their email.
- phyzome 11mo agoI think you misread the question.
- CGamesPlay 11mo agoNot least of which, and even more so the URL had an auth secret in it. None of mine do, hence the question. I'm confused, because git has a credentials helper specifically designed to avoid storing secrets like that, or so I thought. So what tool is storing secrets in the git remote URL? Yes, the git directory has all current and historical versions of the files packed into it, but that's not what the OP used to get information about the scammer.
- phyzome 11mo agoIt's one of several ways to auth to the server. I guess they didn't want to use SSH. And if you use HTTPS instead, you're prompted for your username and password every time -- unless you pass a token.
- xantronix 11mo agoThe URL you see in that fourth screenshot in the Imgur post is from using `git clone` on the the same URL, which was issued on GitHub.
- CGamesPlay 11mo agoHow do you get Github to issue such URLs? No repository lists URLs in that format on Github for me.