How secure is storing password with Git?

Question

I use the Git on my workplace and company policy doesn't allow me to store passwords in unsecure way. Is there any better option than using git config credential.helper store for storing password to the Git server?

P.S. Can't use key-authentication as it's not allowed on our server.

• Schwern: It's better security to avoid passwords altogether. If you can, use ssh and ssh keys to access the repository.
• dk14: Agree, I use it for GitHub, but unfortunatelly our server uses https only. I can't change it as it corporate policy(?).
• Schwern: I hope you mean https.
• Schwern: The question mark tells me you don't know if it's policy. Many times these things aren't. Even if it is, policies can be changed. Up to you to decide if it's worth making the suggestion.

Answer 1

git config credential.helper store is not very secure; as it said in documentation:

Using this helper will store your passwords unencrypted on disk, protected only by filesystem permissions

The ~/.git-credentials file will have its filesystem permissions set to prevent other users on the system from reading it, but will not be encrypted or otherwise protected.

So it stores your password as is. Git allows to use your keychain git config --global credential.helper osxkeychain for OSX, so it seems to be more secure. For Linux system you may use git config credential.helper cache, which stores passwords in your memory. Or you can write your own as it said in git help credentials:

You can write your own custom helpers to interface with any system in which you keep credentials. See the documentation for Git's credentials API for details

Besides, @VonC pointed to the cross-platform GPG-based solution. See also this question about .netrc file.

There is also gnome-keyring helper for Linux (thanks to @jazakmeister for advice)

• VonC: Use the netrc gpg-encrypted credential helper: stackoverflow.com/a/18362082/6309. Works on any platform, Windows, OsX, Linux.
• John Szakmeister: There is also a gnome-keyring helper too.
• MasterJoe: How do I store the password with encryption in windows ?
• dk14: @testerjoe just look at comments above
• moji: I ran git config credential.helper cache in my terminal in Ubuntu, then git pull ask for credentials. Ran git pull once again, credentials were not asked. It works.