Hacker News Reader

Comment by stblack | Hacker News Reader

Hmmm. Maybe you haven't done that from scratch recently? The deprecation of passwords for tokens is a fairly recent thing.

Try it with a fresh laptop: nothing pre-configured. Show someone new how you set up, from scratch.

You're gonna be shocked.

View on HN

The Github team has done a great job on the docs for this process. It's one of the few places I can tell a jr dev to RTFM and send them a link to the Github docs, suddenly they're an expert in SSH and up and running in 10 minutes.

A couple years ago it was harder, but I've done this from scratch on my machines and others' several times over the last few months and it's always easy.

Create keypair, import public key to GH, set git config values, set git remote, done?

I have setup github several times in the last 3 days on fresh Linux installs. It is very easy.

Hey, I keep bouncing between mac and windows, where/how do you store credentials/tokens? I feel like I've got passwords now that I can't memorize and have to save as text somewhere. I'm putting sensitive stuff in a secrets folder with a corresponding gitignore entry, but I feel like there has got to be some well understood way to handle this?

Yubikey is probably the sanest cross-platform solution. Assuming you're using an updated beyond Microsoft's default version, which you'll need to get from https://github.com/PowerShell/Win32-OpenSSH/releases to have support for USB keys, of course. Hopefully MS will update their included version at some point soon.

From there, it's as simple as telling the .ssh/config file to use the key from your Yubikey and you can use the same config file on any machine you have OpenSSH.

Have you done the setup on windows lately? Because AFAIK, (Fido) yubikey support is still missing. Using either the PKCS#11 support or the gpg applet requires some extra piece of software. Also it required telling git to use that specific ssh version, last time I tried a few month ago, the git installer defaulted to something bundled IIRC. Then, you also want to fiddle with autocrlf and other settings. Git on windows is a pain, but that’s not GitHub’s fault.

Yeah. I'm using it right now. After doing a single-time setup and making sure that I keep a backup of the .gitconfig, etc, I haven't had any problems. I made sure to point Git specifically to the OpenSSH I provided (which I keep in c:\utils\openssh) with the following bit in the .gitconfig file:

[core] sshCommand = C:/utils/OpenSSH-Win64/ssh.exe

For GPG, the only things I've done is to use gpg-agent and set up a passthrough for gpg-agent to WSL2 for both OpenSSH and GPG via https://github.com/BlackReloaded/wsl2-ssh-pageant/ since I do development both natively on Windows and via WSL2.

So it’s still as it was when I last set it up: everything is there, but it requires fiddling. I’m using a similar setup right now. One place where Linux has the better experience.

> Because AFAIK, (Fido) yubikey support is still missing.

Correct, hopefully Microsoft will provide an updated SSH client soon. It only requires recompiling OpenSSH with the correct flags.

Alternatively, use these build instruction for openssh with FIDO for windows:

https://gist.github.com/martelletto/6a7cf806c6433ac9ce71d66a...

> Using either the PKCS#11 support or the gpg applet requires some extra piece of software

For those wanting to do that, here are some ways:

Using a premade dll:

https://github-wiki-see.page/m/mooltipass/minible/wiki/Setti...

Or with a middleware:

https://github.com/mgbowen/windows-fido-bridge

Using the Hello API:

https://github.com/tavrez/openssh-sk-winhello

Given how many people came with their own ways, I believe there's enough demand for Microsoft to fix that.

> Correct, hopefully Microsoft will provide an updated SSH client soon. It only requires recompiling OpenSSH with the correct flags.

I checked when Microsoft-owned GitHub announced full Fido support, but I’ve stopped holding my breath.

https://github.com/GitCredentialManager/git-credential-manag... (comes bundled with Git for Windows; you can install it for macOS). SSH is also an option on both platforms, though historically a bit harder on Windows than elsewhere.

(Disclosure, two of the core maintainers of GCM are GitHub employees, though GCM's goal is to work well with any Git host.)

Credentials/tokens go in environment variables. For development, the convention is to make a `.env` file that's in `.gitignore` and load it into your environment variables. In deployed contexts, you often have a system to do this for you.

What sort of tools read .env files/what do I need to know to comfortably set and read environment variables in PowerShell or Bash? Do you just keep the token there in plain text in the .env file?

If you have multiple work stations, do you have a method to keep your secrets synched?

Sorry about all the questions! I appreciate any insight you might have on this though.

One way I see `.env` files used is with NodeJS webservers which will read in the .env file.

But more generally, in shell usage: On Unix machines: direnv https://direnv.net/ (It doesn't support powershell; but I see there are scripts for powershell inspired by this). -- Just be very certain these won't get committed into the repo if you're going to put secrets in them.

I think it's preferable to have different secrets for different machines. (e.g. different SSH keys, or different AWS IAM users - which can each assume a shared role if that's easier to manage).

If you want to sync secrets, one easy way is to use a password database, and then use Dropbox whatever equivalent solution. Another way would be to use e.g. PGP keys. (The public key of a PGP key can be shared between machines, and can be used to encrypt contents for that machine).

There are projects, like for Node there's a dotenv package, that can load these files.

If I have multiple machines, I manually sync them since that's usually the easiest way to manage it as secrets in my experience don't change enough to warrant syncing them.

I use pass[1] as my password manager, and pass-git-helper[2] to serve credentials from pass to git.

[1] https://www.passwordstore.org/ [2] https://github.com/languitar/pass-git-helper

Reply on news.ycombinator.com