Recommendation: use HTTPS with an OAuth credential helper such as Git Credential Manager or git-credential-oauth. A token would mitigate the some of the potential risk of using HTTPS, as tokens can be configured for very specific access privileges and easily be revoked if that token is compromised. If you use HTTPS with a tool (e.g an editor), you should use a developer token from your GitHub account rather than cache username and password in that tools configuration. If you use HTTPS, I would recommend adding two-factor authentication, to protect your account as well as your repositories. SSH can be tunneled over HTTPS if the network you are on blocks the SSH port. I have a different SSH key for each computer, so if that machine gets stolen or key compromised, I can quickly login to GitHub and delete that key to prevent unwanted access. My preference is to use SSH with a passphrase protected key. It will be much easier to try recovery from this breach of you have access to your GitHub account. If a private key is stolen, someone can do a force push of an empty repository and wipe out all change history for each repository you own, but cannot change anything in your GitHub account. If your GitHub account credentials (username/password) are stolen, your GitHub password can be changed to block you from access and all your shared repositories can be quickly deleted. Using a strong keyphrase with your SSH key limits any misuse, even if your key gets stolen (after first breaking access protection to your computer account) SSH Keys do not provide access to your GitHub account, so your account cannot be hijacked if your key is stolen. In my view SSH keys are worth the little extra work in creating them SSH is not always open as a port for communication to external networksĪ GitHub repository is therefore more universally accessible using HTTPS than SSH. HTTPS Is a port that is open in all firewalls. It's simpler to access a repository from anywhere as you only need your account details (no SSH keys required) to write to the repository. I assume HTTPS is recommended by GitHub for several reasons For more information, see " Cloning with HTTPS urls" and " Caching your GitHub credentials in Git." If you clone with HTTPS, you can cache your GitHub credentials in Git using a credential helper. clone URLs work even if you are behind a firewall or proxy.Īn HTTPS connection allows credential.helper to cache your password. The clone URLs are available on all repositories, regardless of visibility. HTTPS is less likely to be blocked by a firewall. There is no inherent flaw in SSH (if there was they would disable it) - in the links below, you will see that they still provide details about SSH connections too: It appears that they currently recommend HTTPS because it is the easiest to set up on the widest range of networks and platforms, and by users who are new to all this. GitHub have changed their recommendation several times ( example).
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |