Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm using TortoiseSVN as my subversion client on Windows 7. My subversion repository has an https URL.

I'm on a public network and I'd like to make sure that my connection to the server is secure. I wonder if TortoiseSVN encrypts my password when it talks to my repository.

share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

If your SVN repository has a HTTPS URL, then all SVN traffic (including your username and password) will flow over that HTTPS (HTTP over SSL/TLS) connection. As far as network traffic is concerned, this is similar to any other HTTPS connection, although SVN uses some additional HTTP WebDav/DeltaV commands.

Your SVN traffic should be highly secure, as long as the administrators maintain a secure SVN webserver and as long as your keep your TortoiseSVN client up to date.

share|improve this answer
    
Does it check the server certificate, though? If not, you may be encrypting your password and sending it to an attacker (the so-called man-in-the-middle attack). –  Marius Gedminas Jul 11 '10 at 13:53
    
The SVN command-line client does check the SSL certificates-- I use it regularly (We run our own Certificate Authority, and provide our own certificates). I haven't used TortoiseSVN lately, but I did read up on it recently, partially in regards to the HTTPS certificate support. TortoiseSVN supports SSL certificates. See tortoisesvn.net/docs/release/TortoiseSVN_en/… . I believe it also will prompt about any problems with the SSL certificate, similar to how a web-browser works. –  Stefan Lasiewski Jul 12 '10 at 17:18
add comment

HTTPS is SSL. It's pretty secure.

Everything beyond the initial DNS lookup will be encrypted.

Note that I'm not sure how TortoiseSVN works. It may open a UDP connection (or an unsecured TCP) connection when sending raw data to the repository. It would be advisable to either check with the development team or open up Wireshark while running a commit and see if there is unsecured traffic going out.

share|improve this answer
    
I believe everything is sent over the HTTPS connection, but checking with Wireshark (or similar) would definitely be a good idea. –  David Z Jun 3 '10 at 17:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.