MacHg icon

About Security And Passwords

When communicating with a server normally a password is required for access to make changes to the repository stored on the server. You have several options available in MacHg.

  1. Use the https protocol

  2. Use the ssh protocol

Important:Be aware that if you store the password for the server directly in the Server URL, then MacHg will store this password in cleartext in your MacHg document. However, all communication with the server is always done using encrypted communication (this is part of https and ssh protocols). Thus you only ever need to worry about password security if someone can obtain direct access to your MacHg document on your machine. If you are worried about this, you can simply store your document in an encrypted disk image. Or you can store your passwords in the system keychain.

One issue with storing your password in the system keychain is that MacHg will contact the server automatically at various intervals to confirm that it is reachable, etc. Thus it may appear to you that MacHg is accessing the server when it shouldn't be, however these access requests are a normal part of the functioning of MacHg.

Note:If you are having connection problems, it is sometimes easier to include the password in the Server URL since it is clearer what is going on when diagnosing problems.

(Note: for comparison, if you are communicating with a server through passwordless ssh, then your ssh keys are also stored in your ~/.ssh directory. Thus anyone with access to your machine will be able to copy your ~/.ssh/id_rsa private key and hence steal your nuclear codes, etc. (To get around this you would need to use ssh-agent.))

Thus, really, the storage of passwords in cleartext in a MacHg document has about the same security as ssh passwordless login.


Related Topics

Adding a Server Repository