Re:Sign arbitrary data with your SSH keys
by Djrhfbfnsks on Saturday November 13, 2021 @07:25AM
(#29209286)
Because they may be used to learn the identity of an otherwise pseudoanonymous github account if one uses the same keys with another account that is tied to his real identity.
Re:Sign arbitrary data with your SSH keys
by OJFord on Saturday November 13, 2021 @08:41AM
(#29209624)
If the account is intended to be anonymous, it should have its own keypair not shared with the real identity (or other independently anonymous account).
I say this regardless of whether public keys are being.. publicised. User database could be leaked, say, or public keys visible to employees/logged. OpenSSH literally refers to them as 'identities' - if you're trying to be anonymous/anon w.r.t. another it goes without saying that you need to not use the same identity!
The private key part is secret of course, never shared (that's where the analogy above breaks) but the public part is fine and desirable for everyone to have access to - that's how they verify that you signed something with your private key, how they encrypt a secret message to you.