You normally have two connection options when connecting to remote Git repositories like Github: HTTPS or SSH. Both have various uses, and...
You normally have two connection options when connecting to remote Git repositories like Github: HTTPS or SSH. Both have various uses, and while SSH is widely thought to be more secure, the issue is a little more convoluted.
What Is The Distinction?
The authentication mechanism you use to connect to a Git repo is determined on the URL your remote has chosen. HTTPS is Github's default URL format, which connects directly over the web protocol:
https://github.com/user/RepoName.git
You can, however, utilise SSH. While you aren't running commands in an interactive shell, the format is the same as if you were connected to a conventional SSH-enabled Linux server:
user@ipaddress:folder/file
You login to the "git" user on Github and most services, and access the.git endpoint as a file in a folder with your username.
git@github.com:user/RepoName.git
Why Should You Use HTTPS?
So, which should you go with? While SSH is normally regarded more secure, HTTPS authentication with a password is sufficient for basic Github usage. In fact, Github uses HTTPS by default and encourages it to most users.
However, it's not as simple as it once was—as of August 2021, Github no longer uses your account password to authenticate. You'll need to generate a Personal Access Token, which functions similarly to a second password but is unique and can have special rights assigned to it. It also allows you to use two-factor authentication on your account without any problems.
There are numerous advantages to using HTTPS:
- HTTPS is less complicated. Except for Github, most sites only need you to enter your account and password before you can push and pull code.
- To use several devices, you don't need to juggle multiple SSH keys.
- HTTPS uses port 443, which is open in almost every firewall that can connect to the internet. For SSH, this isn't always the case.
For most individuals, the main disadvantage is that you must enter your Git password/token every time you push. While it is added to a cache, it is not set to cache indefinitely (though this can be changed). When it comes to SSH keys, it just utilises the key file on disc each time.
Why Should You Use SSH?
It's a common misperception that HTTPS is inherently less secure than SSH. Both will protect you against man-in-the-middle (MITM) attacks and guarantee a secure connection. As long as the underlying keys are secure, both methods will do the same task. Although HTTPS with Git will send your password over the wire, both will employ public-key based authentication. Both protocols can be configured to employ multi-factor authentication (MFA/2FA), while using SSH keys with Github makes it easier to use MFA on your account.
When it comes to the authentication factor—the key—SSH takes the lead. It's difficult to mistakenly leak because of its length, and it's generally more secure because it's ungainly and unique. The only drawback is that it's saved on your hard disc as a user-accessible file rather than in your head, but considering how awful humans are at security, that's probably for the best.
It's also less likely to be affected by a data breach. It's not only guaranteed not to be reused, but it's also never saved on another server. There's no risk of it being disclosed or even transferred over the wire because you just provide Github your public key and use your private key to perform the authentication challenge on your end.
SSH has a lot of drawbacks, but if you know what you're doing, you can minimise them:
- It merely takes a few instructions and clicks in Github's settings to set up your account to use your SSH key.
- It's not easy to manage several keys per computer, but it's not difficult to set up by establishing your SSH host file and Git remotes.
- It is possible to transfer keys to other machines, although this isn't necessary because you can have many SSH keys.
Host github.com Hostname ssh.github.com Port 443
SSH keys can also be linked through SSH agent forwarding, which allows you to connect to a remote server and then authenticate with the SSH key on your client machine. The remote server functions as a go-between, with no knowledge of your SSH key.
What Should You Do With It?
The question is whether it's worth your time. It's not difficult to just use keys if you've used a command line before, and most people will do so anyway because it's faster to configure once and never type a password again. It also works better with 2FA, which should be used by most high-security Github accounts.
If all you want is a simple experience, HTTPS is safe as long as your password is safe. It's the default and even recommended by Github because it works well and is simple to understand.
COMMENTS