Re: [http] Git error messages reveal password encoded in the URL

[Jacob Helwig <jacob.helwig@gmail.com>]

On Mon, Jul 19, 2010 at 14:10, Jakub Narebski <jnareb@gmail.com> wrote:
> Dnia poniedziałek 19. lipca 2010 23:05, Jacob Helwig napisał:
>> On Mon, Jul 19, 2010 at 14:02, Jakub Narebski <jnareb@gmail.com> wrote:
>>> Ketan Padegaonkar <ketanpadegaonkar@gmail.com> writes:
>>>
>>>> We use http to serve our git repos, in order for git to not ask me a
>>>> username/password everytime,
>>>
>>> Errr... WTF?  Can't you configure SSH (use ssh-add, perhaps together with
>>> tool such as keychain) to use public key based authentication?
>>>
>>
>> I don't think SSH/ssh-agent/pubkey would actually help, given that
>> it's a https URL.  Unless I'm missing something here?
>
> I was referring to 'we use http [...] _in order_ for git to not ask me
> a username/password everywhere'.  I just noted that you can make git
> not ask a username/password everywhere when using ssh:// URLs.
>

Ah, I read it to mean "We use HTTP.  I encode the user and password in
the URL to prevent it from asking all the time", not "We use HTTP with
an encoded user and password to prevent it from asking".  If it's the
latter, then you're definitely right: Using SSH + pubkey
authentication is probably a _much_ better choice.