Is standalone Git protocol susceptible to MITM where an attacker impersonates the server?
There are 3 main protocols to use with a git server: HTTP, SSH and Git.
For HTTPS and SSH it sounds like it's possible to use some kind of binding to ensure we are connecting to the right server and protect against MITM attacks.
What about Git by itself?
The above link says that
The downside of the Git protocol is the lack of authentication. It’s generally undesirable for the Git protocol to be the only access to your project.
I think they are talking about authentication of the users here though and not the servers. Having said that, there doesn't seem to be any mention of server authentication.
Does anyone know? Thanks!