• MostlyHarmless@programming.dev
    link
    fedilink
    arrow-up
    5
    arrow-down
    2
    ·
    1 year ago

    That’s how a lot of tools work. Your maven password is in .m2/settings.xml

    Your ssh private key is in .ssh/id_rsa

    The only person with access to these files should be you. If anyone else does then your machine is compromised

    • HairHeel@programming.dev
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      we’re talking about a hypothetical one-off situation on a computer that isn’t yours though; right? That happens from time to time, and an authentication process that requires you to persist your auth information on disk carries some extra risks. You need to remember to delete it when you’re done.