> Did you know that ssh sends all your public keys to any server it tries to authenticate to?
Never really thought about it. Feels kind of "leaky", even if necessary.
Never really thought about it. Feels kind of "leaky", even if necessary.
Feels weird, but it's like going into a building that requires a badge and showing proof that you actually own several keys, then the building guard telling you he needs X key to enter since that's the one they know, and it's authorized.
All your public keys in your GitHub account are accessible through a link, just <github.com/<username>.keys>
I might be pushing the analogy too far, but: all the URLs I have visited are public and are not identifying me personally, yet uploading them all together to a third party feels like a breach of privacy.
Here's one of my public keys, for free: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICIc3nOnSnsiAdkjAdH5WR9enQiPYWq1zAVsTDt60e91
To prevent