Configure Git clients, like GitHub for Windows, to not ask for authentication

Question

I have installed GitHub for Windows and also GitExtensions and have multiple versions of git.exe in my path.

C:\Users\Rajat\AppData\Local\GitHub\PortableGit_93e8418133eb85e81a81e5e19c272776524496c6\cmd\git.exe
C:\Users\Rajat\AppData\Local\GitHub\PortableGit_93e8418133eb85e81a81e5e19c272776524496c6\bin\git.exe
E:\cygwin\bin\git.exe
C:\Program Files (x86)\Git\cmd\git.exe
C:\Program Files (x86)\Git\bin\git.exe

Now, when I do git push origin master with any of the last three git.exes, it asks for my username. But the Portable Git doesn't ask for username. See the following screenshot:

The heart-shaped character is just a ^C so ignore that.

How is authentication being taken care of in this case? Ultimately I want the last three Gits to not ask for authorization. How's that possible?

I found two extra files in the GitHub's Git but I doubt they matter at all:

Solution 1

For GitHub for Windows itself, Paul Betts (GitHub staff) gently reminds everyone that G4W already includes a credential helper (based on CryptProtect and I suppose the CryptProtectData function)
See his answer below.

For those who don't use G4W, read on.

---

To add to my previous answer (when pushing to GitHub through the console/command-line):

A file like ~/.netrc (on Unix) or %HOME%/_netrc (on Windows) can help you to avoid entering your credential for every git push you would make to GitHub.

You can store as many credentials you need in a netrc file.
(for GitHub or other repo hosting providers)
But:

• you don't want to store your main GitHub password account
• you don't want those in a plain text file.

The following sections address those issues:

---

Enable the two-factor authentication (2FA) on your GitHub account

(September 3rd, 2013)

Configure 2FA through an application, always through an app, never through a text SMS, if you can avoid it.

The reason is, through that activation process, you have access to your two-factor secret key, which is used to generate the second factor authentication every 30 seconds:

That way you can go to any GAuth (Google Authenticator) client, enter that same 2FA secret key, and see the exact same code you would get through SMS message.
Except that, if you don't have phone service, it still works ;)

Of course, the first client to use is GAuth on your android phone or your iphone.

That means you don't have to wait for an SMS, and you keep your 2FA on your phone.

However, having your secret key allows you to not be limited to a client on your phone.
You can go to any other client, like:

• JAuth, a beautiful two factor desktop client, (codeon GitHub)
• html5-google-authenticator: a GAuth Authenticator client web page where you can see your token generated every 30 seconds, like you would see them on your phone or through SMS.
• a desktop system tray
• a browser extension (like gauth-authenticator for FireFox)

For all those clients (on your phone with GAuth, or with a desktop client or a web page), you will need your two-factor secret key.

If you activated your 2FA through SMS:

• you don't know your secret key
• you can't use any other GAuth client
• you are limited to receiving your token through your phone (if you have phone service and/or if you have your phone at all)

---

Note: if you have added a key in your Gauth client on Android, without having memorized first said secret key, all is not lost.
(but you need a rooted phone though)

$ adb shell
# sqlite3 /data/data/com.google.android.apps.authenticator/databases/databases
sqlite> select * from accounts;
1|[email protected]|your2factorkey|0|0
sqlite> .quit
#exit

---

Don't forget to get and then save the associated recovery codes (in the Account Settings section of your GitHub account):

(See also the last section about where to save those codes)

---

Encrypt your _netrc file

(see the credential helper netrc with git1.8.3+: gpg encryption)

You need to encrypt in that file at least those two credentials:

machine github.com
login username
password xxxx
protocol https

machine gist.github.com
login username
password xxxx
protocol https

You then keep only a ~/.netrc.gpg or %HOME%/_netrc.gpg

But, if you enable the new two-factor authentication described above, 'xxxx' won't be your GitHub account: see the next section about "Personal Access Token".

---

Generate a Personal Access Token

You won't be able to push with your GitHub password if you have activated 2FA.

Anonymous access to user/repo.git denied

Here is what you would see (the gpg part is because I use the netrc credential helper):

C:\Users\VonC\prog\git\git>git push origin
Using GPG to open %HOME%/_netrc.gpg: [gpg2 --decrypt %HOME%/_netrc.gpg]

You need a passphrase to unlock the secret key for
user: "auser <[email protected]>"
2048-bit RSA key, ID A2EF56, created 2012-09-12 (main key ID DC43D6)

remote: Anonymous access to VonC/git.git denied.                      <=====
fatal: Authentication failed for 'https://[email protected]/VonC/git/'  <=====

So go to the Developer section of your GitHub Account (subsection Personal access tokens), and generate a Personal Access Token:

That token won't require a two-factor authentication: you can use it as password in your _netrc file, and you will be able to just push to GitHub.

But the difference with your main GitHub account password is:
You can revoke a personal access token (and generate a new one), while still keeping your main password unchanged.

If you had encrypted your main GitHub password in your ~/.netrc.gpg file, you can replace it with your new personal token:

gpg -d %HOME%\_netrc.gpg | sed "s/yourPassord/YourPersonalAccessToken/g" | gpg -e -r auser --yes -o %HOME%\_netrc.gpg

In multiple line for readability:

gpg -d %HOME%\_netrc.gpg | 
  sed "s/yourPassord/YourPersonalAccessToken/g" | 
  gpg -e -r auser --yes -o %HOME%\_netrc.gpg

That works even on Windows, with the help of the unix-like GoW (Gnu on Windows) command, which includes sed.

---

Save your GitHub credentials

I recommend an online credential storage like lastpass.com

You need to save:

• Your GitHub account password
• Your 2FA secret key
• Your 2FA recovery code
• Your personal token

Solution 2

If you're using GitHub for Windows, all you need to do is:

1. Make sure you've logged into the GUI app at least once
2. Click the "Git Shell" link

GitHub has already solved this problem for you on the command line, for both HTTPS and SSH-based remotes

Solution 3

https://help.github.com/articles/set-up-git

The password caching section says:

If you don't want to use GitHub for Windows, you can download the helper for your OS here:

Do that and any other git.exe will work without asking for password. :)

Comments

[VonC]

@lunakid you just reserve a bit of time every day: it is good training. (And I do mean: Every. Single. Day. meta.stackexchange.com/q/122976/6309)

[cwhisperer]

This answer might be long, but it's also really incorrect. Nobody should be doing this. Can you please remove this?

[cwhisperer]

This is the correct answer, everyone saying "Use _netrc" is extremely out-of-date.

[Juliano]

@PaulBetts why is it incorrect? why should nobody be doing this?

[VonC]

@Juliano at the time in 2014, Paul had integrated with GitHub for Windows a manger for password caching. And these days (2016), you don't even need that with Git For Windows (github.com/git-for-windows/git/releases) which comes with the github.com/Microsoft/Git-Credential-Manager-for-Windows (Git Credential Manager for Windows). But I still prefer my own way to cache passwords ;)

[Quantum7]

Note that github's personal access tokens are now under 'Developer settings' not 'Application'

[VonC]

@Quantum7 Thank you. I have edited and updated the answer accordingly.

[Timo]

Can I use the personal access token on more than one client? I use windows and linux. On linux, it works, on windows I get Exception has occurred: GithubException and I see strange characters at the begin: ÿþ. Related to encoding? I have utf-16 le in vscode. Reopen with encoding in vscode utf-8 gives more strange chars.

[Timo]

Wait - it seems to work with changing to utf-8 as encoding.

[VonC]

@Timo It should work indeed with utf-8. ÿþ is UTF-16 (LE) (en.wikipedia.org/wiki/…)

[VonC]

@Timo I prefer not reusing a token though, as I explained in stackoverflow.com/a/55135350/6309 and stackoverflow.com/a/51505417/6309.