-
Suggestion
-
Resolution: Fixed
When Bitbucket and Atlassian release two-step verification (two-factor authentication), some applications that rely on basic authentication may no longer work as expected. While Bitbucket recommends that third-party application developers switch to using OAuth, there are still many applications where https may be the only option.
Application specific passwords would allow users to create a password that would allow them to use Git, Mercurial, and the API over https as needed.
[BCLOUD-11774] Application specific passwords or tokens (BB-14202)
Attachment 2850987722-Screen%20Shot%202016-05-30%20at%2012.49.13.png has been added with description: Originally embedded in Bitbucket issue #11774 in site/master
App passwords have the following benefits:
- Isolation – you can have one password per integration / application and manage leaks better.
- Scoping – the app password creation screen allows you to set which permissions the app password should receive so you're not giving away all the keys at once.
- Limited functionality – even with all scopes present, you cannot log into the web UI with an app password. You also cannot create additional app passwords, SSH keys or OAuth tokens with an app password. This makes it harder for someone to use an app password to create a second back door in your account.
That and they can be revoked without you having to change your account password. And if used properly (I.e. one password per application) you should easily be able to spot which one leaked which may well give you a hint as to what might have gone wrong (What computer, network etc is compromised).
App passwords are useful as not all software supports 2FA login, in software that doesn't support it you just simply can't use it without disabling 2FA account-wide without this feature.
I'm a little confused about why an app password is any more secure than passing the user/pass as basic auth.
A packet-sniffer could still easily walk away with your app password, and use it for bespoke api calls (within the permissions scope of that password of course).
So, am I missing something? What exactly is the advantage?
@waltherg Bitbeaker uses OAuth, so you should use your regular Bitbucket account credentials to log in to it. App passwords can only be used for HTTPS API calls.
Hi Ben,
Congrats on the public release of app passwords!
In the blog post, you might want to change the words "to just do that" to
"to do just that", otherwise it sounds like it's limiting what you can do.
Cheers,
Andrew
App passwords are now available for all Bitbucket users! Check out the blog post for more info: https://blog.bitbucket.org/2016/06/06/app-passwords-bitbucket-cloud/
Sourcetree does not support 2FA , we have to use App passwords as a work around which is not ideal.