[f1shy]

I really do bot understand the policy of github. Before I could have a 40 char password in my head. Now it MUST be somewhere in my disc. I was totally surprised as I learned is the only way to login. Seems a 50 year old idea

[Wool2662]

And yet the likelihood of you telling someone or typing the contents of this file somewhere you shouldn't is much lower. It's more phishing resistant and is much less likely to be in some leaked password database, that's what GitHub cares about. Targeted attacks on single people don't even move the needle.

Phishing and password stuffing attacks are like 95% of 'hacking' attempts.

And frankly it is very likely that your 40 character password landed in your shell history at least once.

[predictabl3]

GH also prefixes them and undoubtedly scans for and invalidates them.

I don't think I ever cringe as much as HN threads with people clamoring for backwards steps for security.

[kasdi]

Might want to check out 1Password CLI which can eliminate the need to store access tokens on disk.