Remove password from mercurial_keyring (TortoiseHg on Windows)

Question

I am running TortoiseHg on Windows XP. I have the mercurial_keyring extension enabled.

Once a password is stored via the mercurial_keyring extension, is there any way to remove it?

A typical use case for this would be:

User A has no push privileges on a remote repository. User B, who is co-located, does have push privileges. User B enters his username and password on User A's machine to allow the push to happen.

How would I remove User B's credentials from User A's machine?

Answer 1

Win32 API calls to CredRead and CredWrite are used to save to the keyring. In other words, mercurial_keyring is saving credentials that you can manage with Windows Credential Manager (Win7), for XP it will be Run- rundll32.exe keymgr.dll, KRShowKeyMgr

From other side

Passwords are identified by the combination of username and remote address

thus, if hg-username of UserB isn't public, UserA will not get privileges escalation

Answer 2

在Windows 7上，您可以按照此处的说明操作（控制面板 - >用户帐户和家庭安全 - >凭据管理器，并删除所有“Mercurial”）。

Answer 3

On Windows 8 and 10 it is:

Control Panel > User Accounts > Credential Manager > Windows Credentials.

Answer 4

In such a case I would probably just disable extension before pushing, still of course it is easy to forget it.

Having some way to clear the password is reasonable expectation, I will think about adding sth. Issue to follow: https://bitbucket.org/Mekk/mercurial_keyring/issue/45/some-way-to-clear-password-and-maybe

Update This is implemented since mercurial keyring 1.1.0 (published Nov 2015), mercurial keyring now brings

hg keyring_clear «path»

command which clears the password. It is less cute than using GUI tools, but works for any password backend (and uses exactly the same API which is used to save the password and the same logic to pick the proper backend).