As has been mentioned (repeatedly) this obviously has no use for people using SSH. Indeed, the goal of this tool is explicitly to be helpful for cloud-hosted repositories in Visual Studio Team Services (formerly Visual Studio Online). This is helpful for teams that enforce two-factor authentication over HTTPS. The article assumes a bit of knowledge about this, but does indeed mention this:<p>> We ported this tool to Mac and Linux to simplify their authentication to remote Git repositories, in particular those hosted in Visual Studio Team Services (VSTS).
This is not yet for those who use SSH. It's for situations where multi-factor authentication is required, including SMS, phone call, etc. SSH support on VSTS Git repos is coming soon: <a href="https://visualstudio.uservoice.com/forums/121579-visual-studio-2015/suggestions/3801342-add-support-for-ssh-keys-as-alternate-authenticati" rel="nofollow">https://visualstudio.uservoice.com/forums/121579-visual-stud...</a>
I am baffled why would they try to port this for Mac / Linux which already has SSH functionality built-in. It can make sense on Windows where there is no equivalent, by default.
I like the idea of adding second-factor authentication to your Git credentials. But doing this using OAuth to a cloud service just seems like the wrong approach. Use SSH keys, and then either (a) set a good password on your key, or (b) store the key on a hardware token, like a Yubikey. [1]<p>I think the big problem here is that they're using HTTP(S) as a transport for Git. And there's just not very many options left for layering on extra security if you do that.<p>[1]: I'm a big fan of Yubikeys for credential storage. You can put them in PGP Smartcard mode, and then use the PGP key with SSH: <a href="https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubikey-neo/" rel="nofollow">https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubike...</a>
Remember Microsoft's patented triple-e tactic:<p>1. Embrace<p>2. Extend<p>3. Extinguish<p>We're at step 2. They've gotten pretty fast at it, I must say.
OAuth for SSH? What the hell are you guys doing? No, stop. <i>Stop.</i> Drop it. Go back to the drawing board and learn what SSH can do apart from password and public key auth (hint: Everything from challenge-response schemes to Kerberos).
On the front page:<p>3 mentions of Visual Studio, 2 mentions of Microsoft, 1 mention of ASP.NET<p>Yes, yes, yes Microsoft are still bleeding edge with the software :)