SSH or HTTPS

[kabouzeid]

Which one is the recommended git_protocol in gh and why?

[mislav]

The default on both github.com (the website) and in GitHub CLI is using the HTTPS protocol for git operations. This default was chosen for interoperability and ease of use:

• Git users who are behind firewalls find that traffic to port 443 (HTTPS) is more often allowed than traffic to port 22 (SSH).
• Git authentication for HTTPS is arguably easier to set up than SSH keys, especially with gh auth login. Upon completion of the login flow, GitHub CLI will configure itself as a git credential manager and ensure that all git operations for https://github.com are authenticated with gh's own token.

Some users prefer SSH for git operations, arguing that SSH key authentication is more secure than sending credentials over HTTPS. I'm not a security expert so I can't comment on the tradeoffs of SSH vs. HTTPS, but my personal recommendation is that for the average user, HTTPS offers adequate security. Usability-wise, SSH key authentication can have some hurdles:

• SSH key pairs are typically generated on the command line using cryptic commands such as ssh-keygen -t ed25519 -C "your_email@example.com" and a series of steps including deciding on an adequate passphrase.
• Once generated on a single machine, the user should typically back up their keys so they can keep using them across machines.
• Users are responsible for having ssh-agent running on the machine and adding their key to it, which usually involves passing in the passphrase.

To tell GitHub CLI that you prefer the SSH protocol for git operations, you can do:

gh config set git_protocol ssh --host github.com

Because of the steps and knowledge involved, my personal recommendation is that SSH keys are only used by users who have a strong reason to do so.

If you find yourself doing work with git repositories in an organization, ask within your organization which mode of security they prefer.

[kabouzeid]

Makes perfect sense now, thank you for explaining the reasoning :)