将 googlecode 密码包含在 .git/config 中是否危险？
因为我的 .netrc 文件的技巧不起作用（即使它具有正确的文件权限），所以我将本地 .git/config 修改为如下所示：
[remote "origin"]
fetch = +refs/heads/*:refs/remotes/origin/*
url = https://<username>:<password>@code.google.com/p/<project>/
我立即克隆了存储库以检查是否仍包含密码，并且事实并非如此。
如果重要的话，我还在 github 上托管了一个镜像。
那么它有什么危险吗？
Because the trick with my .netrc file doesn't work (even though it has correct filepermissions), I modified my local .git/config to like like so:
[remote "origin"]
fetch = +refs/heads/*:refs/remotes/origin/*
url = https://<username>:<password>@code.google.com/p/<project>/
I immediately cloned the repo to check if the password would be still included, and it isn't.
I also have a mirror hosted at github, if it matters at all.
So is it in any way dangerous?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
.git目录中的文件严格属于本地存储库的一部分；它们不会被推送到您的远程存储库。因此，您不会在网络上发布密码，因此您是安全的。另一方面，任何要求您将密码缓存在本地文件系统上的系统都意味着有权访问您的文件系统的人有可能恢复您的密码。不幸的是，由于 Google 不支持通过 ssh 访问存储库，因此您对此无能为力（好吧，您可以决定专门使用 Github，这可以让您进行公钥/私钥身份验证，这在安全性方面是一个重大进步）。
关于
.netrc文件的使用，Google Git FAQ 说：Files in your
.gitdirectory are strictly part of your local repository; they don't get pushed to your remote repositories. So you're safe in the sense that you're not publishing your password on the network.On the other hand, any system that requires you to cache your password on your local filesystem means that someone with access to your filesystem can potentially recover your password. Unfortunately, since Google doesn't support repository access over ssh, there's not much you can do about this (well, you can decide to use Github exclusively, which gets you public/private key authentication which is a substantial step up in security).
Regarding the use of the
.netrcfile, the Google Git FAQ says: