Do not require github username / password

[chrissound]

#645

This is horrifying that you require a username / password of github just to "encrypt" some variables. It's a serious security issue, and should probably be handled by Oath with Github's API instead.

[Benjamin-Dobell]

TravisCi doesn't ever ask you for your Github password. It logs in to your Github account using tokens.

However, there is a related issue that travis-ci.com requires way more permission than necessary just to login from CLI, namely:

• read:org
• repo
• user:email

If you've already got an account with TravisCI then it's already been granted OAuth permissions. In which case the token to login from CLI shouldn't require any scopes at all i.e. You're just proving to TravisCI that you are a particular Github user; that's it.

[vatosarmat]

As you can see above, it will ask you for your GitHub user name and password, but not send these to Travis CI. Instead, it will use them to create a GitHub API token