What is askpass.exe?

[jesper gothe]

I am constantly annoyed by an application that asks for my password. The executing file is askpass.exe. It has a logo that looks like a cheap China version of the source tree logo. Is this an official software from atlassian or is it malware ?

[Balázs Szakmáry · Accepted solution]

The first result of Googling for this says that it is a SourceTree component.

Check and correct your stored credentials in Tools\Options\Authentication to make it stop asking for your password all the time.

[minnsey]

This is correct, askpass.exe is part of the SourceTree distribution. It is provides a GUI to allow SSH via Git to ask for a username's password to access their SSH key, via the SSH_ASKPASS variable.

[Phillip Norman]

Well ... we are not using SSH ... so this should not bother us AT ALL!!! (But it does for some people, some of the time.) What a joke!!!

[xdev · Accepted solution]

WTF is that crap and how to solve it??

[tanderso]

I also have this issue. There is definitely a bug somewhere in Sourcetree authentication. The AskPass.exe connection issue warning has been randomly popping up from time to time for about a month. It's really annoying.

I verified that the stored credentials in Tools\Options\Authentication are correct. It says "Authentication OK" at the bottom left. However, I do notice that the button "Refresh OAuth Token" does not work. After a few redirects there's a link like http://localhost:34106/?state=authenticated&code=KjjPkTZFBLmbp4Q2vK in Chrome that warns:

This site can’t be reached

localhostrefused to connect.

• Search Google for localhost 34106

ERR_CONNECTION_REFUSED

After I restart Sourcetree my account will be logged in properly, and sometimes I need to do that to be logged in.

[tanderso]

To follow up, the redirect has stopped going to "This site can't be reached" and seems to be resolving properly. Also the disconnections seem to be much less frequent. The last one seemed to relate to a Sourcetree incident (happened at the same time as a minor service issue posted on the website). There hasn't been an update in SourceTree since November so maybe a backend change improved it.

(Also to clarify, the warning popups occurred when Sourcetree is running in the background).

[Jeff_Klosinski]

I also get it multiple times a day, and it's very annoying.  

[akoster]

And this is expected behavior? From commercial software? I know that Sourcetree itself is free, but with all of the subscription fees that we pay for other Atlassian software, you'd think that they would be able to fix a bug that's bad enough that I'm just going to switch to Git Kraken and stick with that.

[jesper gothe]

OK, thanks for a quick reply. Of course I tried google first. The file is signed and this is a good sign.  However there is loads of sites that writes about suspicious files. All of them advertise different tools they want me to install. If I would have spent more time on http://systemexplorer.net/ maybe I would have trusted this answer right away. But I choosed to ask in a more trusted forum (here).

Giving someone else access to my employers source code through malware would have been pretty embarrassing.

[Charles Tilley]

I was experienced a different issue where the pop-up was related to being unable to locate the .exe. If anyone else is having issues with this, I was able to get the popup to stop appearing by ensuring that the environment variable SSH_ASKPASS was set to the SourceTree Askpass.exe file in .bashrc:

export SSH_ASKPASS="[PATH]\SourceTree\app-3.3.9\tools\Askpass.exe"

[xdev]

Same problem here. What's that crap and how to solve it?!

Regards, Jan

[akoster]

So is there any way to prevent this virus-looking popup that kicks me out of whatever app I was actually using when Sourcetree decides to do this shady shit? Or do I have to just stop using Sourcetree? This is a terrible bug and it has been around for like 5 years!

[tanderso]

To be fair, I'm not sure that it's popping up due to the same bug as 5 years ago.

It wasn't happening when I first installed, but last year it was happening quite frequently, an average of once a day.  It's still popping up for me but now only very occasionally, around once a week. 

Unfortunately it is not documented

https://confluence.atlassian.com/search/?query=askpass.exe

Since I've brought it up as a community question, and see others also experience it, problably the next step is to file it as a bug report? But I do see that there are ~19 reports regarding askpass.exe.  https://jira.atlassian.com/browse/SRCTREEWIN-4370?jql=project%20%3D%20SRCTREEWIN%20AND%20text%20~%20%22askpass.exe%22 One comment says "AskPass.exe pops up about every 15 seconds." Luckily that is not the case for me.

[Phillip Norman]

Unfortunately, the Jira pages for Sourcetree are a complete waste of space. I reported issues THREE years ago that, in my consideration were worthy of a reasonably prompt fix, have never been fixed. People in the team I work in have experienced this askpass issue. One temporarily resolved the issue (coincidence?) by updating Sourcetree to 3.3.8, but the error has now re-appeared and another team member now has the problem :( . My solution? Stop using Sourcetree! I now use GitExtensions.