Google Says: Put Your Password Plainly in a File: Linux .netrc

2012-08-15 Google Code tells its users to put password in a plain file. Here's a screenshot:

Here's a text quote:

Add the following to your .netrc.
machine code.google.com login xahlee@gmail.com password [generated googlecode.com password]

That's storing passwords in the plain. Amazingly, git uses .netrc, in the year of our load 2012.

This especially dangerous today with {dropbox, google drive, …} etc cloud storage. All your server passwords are consolidated in a single file in the plain.

Where are the unix faakheads who incessantly bitch about the security slack of Microsoft?

What is .netrc?

“.netrc” began as a way to store passwords so that ftp access can be automated in a script, without user having to type password.

Here's a excerpt from man netrc:

netrc(5) - Linux man page

Name

netrc, .netrc - user configuration for ftp

Description

This file contains configuration and autologin information for the
File Transfer Protocol client ftp(1).

The .netrc file contains login and initialization information used by
the auto-login process. It resides in the user's home directory. The
following tokens are recognized; they may be separated by spaces,
tabs, or new-lines:

    machine name

    Identify a remote machine name. The auto-login process searches
    the .netrc file for a machine token that matches the remote
    machine specified on the ftp command line or as an open command
    argument. Once a match is made, the subsequent .netrc tokens are
    processed, stopping when the end of file is reached or another
    machine or a default token is encountered.

    default

    This is the same as machine name except that default matches any
    name. There can be only one default token, and it must be after
    all machine tokens. This is normally used as:

    default login anonymous password user@site

    thereby giving the user automatic anonymous ftp login to machines
    not specified in .netrc. This can be overridden by using the -n
    flag to disable auto-login.

    login name

    Identify a user on the remote machine. If this token is present,
    the auto-login process will initiate a login using the specified
    name.

    password string

    Supply a password. If this token is present, the auto-login
    process will supply the specified string if the remote server
    requires a password as part of the login process. Note that if
    this token is present in the .netrc file for any user other than
    anonymous, ftp will abort the auto-login process if the .netrc is
    readable by anyone besides the user.

…

Linux NetKit (0.17) September 23, 1997 Linux NetKit (0.17) 

…    

Here's stackoverflow articles telling people how to use the “.netrc” file:

• [Git - How to use .netrc file on windows to save user and password 2011-05-17 At http://stackoverflow.com/questions/6031214/git-how-to-use-netrc-file-on-windows-to-save-user-and-password ]
• [using .netrc with sftp 2009-09-01 At http://stackoverflow.com/questions/1360672/using-netrc-with-sftp ]

Note: if Google supports git over ssh protocol, then the manual-typing-password problem can be solved. See: https://wiki.archlinux.org/index.php/SSH_Keys. However, Google does not plan to support git over ssh (See: http://code.google.com/p/support/wiki/GitFAQ). See also:

• Git Credential Helpers 2012-04-11 By Written David Blewett. At http://www.sixfeetup.com/blog/git-credential-helpers
• Permanently authenticating with Git repositories 2012-04-11 At https://confluence.atlassian.com/display/STASH/Permanently+authenticating+with+Git+repositories

2012-08-16 thanks to [Evan Cofsky https://plus.google.com/100057108497749693760/about] and Tom Novelli for help.