On Dec 11, 2015, at 3:18 PM, Daniel Dumitriu <daniel.dumit...@gmail.com> wrote: > >> Why can’t you just use SSH keys? The wish for automated login without >> leaking passwords is exactly the problem they solve. > I can and I do. But maybe other users cannot
Why “cannot”? I get “will not,” but “CAN” not? You’re asking for Fossil to add a way for your users to shoot themselves in the foot, when there is a perfectly sensible alternative available. PuTTY ships with a tool that can create SSH keys. > By the way: Does the whole reasoning not hold for https URLs? They allow > a password on the command line, too. No, because HTTP basic authentication is a thing: http://fossil-users.fossil-scm.narkive.com/ClIwmXcA/command-line-option-for-http-auth If you’re using Fossil + HTTP basic auth + HTTPS, then yes, putting the password in the URL is a problem. But, Fossil can get the password interactively instead, remember it, and send it in HTTPS instead, so no foot-shooting. >>> Side note: as for the security risk, I agree in principle, but since the >>> user has already decided to type in his password on fossil's command >>> line, the evil is there and passing it to plink makes it no worse. >> >> A password interactively typed into ssh/plink is as secure as the box it’s >> running on. > My example was for cases where the user does *not* type his password > into plink since, well, vanilla plink launched by another process does > not prompt for a password - the initial reason for my post. Sorry, I’m not terribly familiar with PuTTY. I use Cygwin OpenSSH or SecureCRT on Windows wherever possible. I’d say take it up with the plink developers, then. It *should* do interactive prompting in this case. _______________________________________________ fossil-users mailing list fossil-users@lists.fossil-scm.org http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
