Hacker News Reader

Comment by CGamesPlay | Hacker News Reader

What leads to the secret being stored in git's config file like that? None of my repositories have that, the remote URLs all just say "git@github.com:foo/bar.git".

View on HN

The way Git computes diffs is by more or less storing all the source code in the .git directory as objects. At first glance it looks like a bunch of hashes, but tools can pull out source code from the objects tracked within the .git directory. Not least of which, the remote URL points to their username on GitHub and the author for commits can give you their email.

I think you misread the question.

Not least of which, and even more so the URL had an auth secret in it. None of mine do, hence the question. I'm confused, because git has a credentials helper specifically designed to avoid storing secrets like that, or so I thought. So what tool is storing secrets in the git remote URL?

Yes, the git directory has all current and historical versions of the files packed into it, but that's not what the OP used to get information about the scammer.

It's one of several ways to auth to the server. I guess they didn't want to use SSH. And if you use HTTPS instead, you're prompted for your username and password every time -- unless you pass a token.

The URL you see in that fourth screenshot in the Imgur post is from using `git clone` on the the same URL, which was issued on GitHub.

How do you get Github to issue such URLs? No repository lists URLs in that format on Github for me.

Reply on news.ycombinator.com