All of lore.kernel.org
 help / color / mirror / Atom feed
From: Junio C Hamano <gitster@pobox.com>
To: Jeff King <peff@peff.net>
Cc: M Hickford via GitGitGadget <gitgitgadget@gmail.com>,
	git@vger.kernel.org,  sandals@crustytoothpaste.net,
	 stolee@gmail.com, Johannes.Schindelin@gmx.de,
	 rsbecker@nexbridge.com,  M Hickford <mirth.hickford@gmail.com>
Subject: Re: [PATCH] credential: warn about git-credential-store [RFC]
Date: Sun, 02 Feb 2025 15:41:05 -0800	[thread overview]
Message-ID: <xmqqo6zj3ofi.fsf@gitster.g> (raw)
In-Reply-To: <20250201025413.GB4088801@coredump.intra.peff.net> (Jeff King's message of "Fri, 31 Jan 2025 21:54:13 -0500")

Jeff King <peff@peff.net> writes:

> On Fri, Jan 31, 2025 at 07:48:06PM +0000, M Hickford via GitGitGadget wrote:
>
>> From: M Hickford <mirth.hickford@gmail.com>
>> 
>> git-credential-store saves secrets unencrypted on disk.
>> 
>> Warn the user before they type their password, suggesting alternative
>> credential helpers.
>> 
>> An alternative could be to warn in "credential-store store". A
>> disadvantage is that the user wouldn't see the warning until after they
>> typed their password, which is less helpful. The warning would appear
>> again every time the user authenticated, which feels too frequently.
>
> I certainly don't disagree that "store" is relatively insecure,
> but...who are we trying to help here? We do not turn on "store" by
> default, so anybody who is running it would had to have explicitly
> configured it as a helper. And there's a big warning already at the top
> of the manpage.

I buy this argument.  I think an earlier comment by brian was on a
similar wavelength.

Thanks.


  reply	other threads:[~2025-02-02 23:41 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-01-31 19:48 [PATCH] credential: warn about git-credential-store [RFC] M Hickford via GitGitGadget
2025-01-31 20:05 ` Junio C Hamano
2025-02-01  2:54 ` Jeff King
2025-02-02 23:41   ` Junio C Hamano [this message]
2025-02-01 10:07 ` brian m. carlson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=xmqqo6zj3ofi.fsf@gitster.g \
    --to=gitster@pobox.com \
    --cc=Johannes.Schindelin@gmx.de \
    --cc=git@vger.kernel.org \
    --cc=gitgitgadget@gmail.com \
    --cc=mirth.hickford@gmail.com \
    --cc=peff@peff.net \
    --cc=rsbecker@nexbridge.com \
    --cc=sandals@crustytoothpaste.net \
    --cc=stolee@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.