Search code examples
gitgithubopenssh

Does Git OpenSSH store entered usernames?

When pushing changes to GitHub in Git via OpenSSH, I accidentally typed my password in the username prompt (I got confused because the username prompt also masks the characters with asterisks).

So when the actual password prompt came up I got a nasty surprise:

Password prompt shows https://{my password}@github.com

Since I entered my password for the username, should I worry about my password being stored in plaintext anywhere, both on Git's logs on my computer and on GitHub's servers?

I am using Git 2.23.0 on Windows 10.

Solution

  • In this case, you're not actually using SSH; you're using the SSH askpass tool to prompt for HTTPS credentials, so you don't need to worry about what OpenSSH does. The askpass tool itself will of course handle credential input safely without logging. However, your username is sent to the remote server, so if you submitted the password field, your password is now almost certainly in GitHub's logs (unless it was a GitHub token, since GitHub allows those in the username field in some cases and handles that securely).

    If you didn't actually submit the actual password field prompt that showed up, then the password in the username field was not sent anywhere, since the HTTP protocol sends them as one unit. Since the credential prompt would have failed, no connection was made, and you don't really need to worry about it.

    Since this is for HTTP, if you're using a credential manager, such as the Git Credential Manager or wincred, and the password was sent, then you may want to inspect the Windows credential store to see if it's been saved in a username field there. That would be encrypted, though, but the data could be sent again if the credential helper fills it in.

    If the password was sent, you have to assume that anything that uses that password is now compromised and change it everywhere it's used. If you were using a token, then replace it with a new one. If you're using the same password in multiple places, take this opportunity to get started with a password manager so that this kind of thing is less of a hassle if you ever do it again (and we all have).