Can you explain to me any way in which they might not, bearing in mind they're basically text.
It being "basically text" doesn't matter; a pdf can be mostly just text but that doesn't mean in any shape or form that it's searchable.
Not sure if you're aware, but older protocols are still around to be used for this use case, and Gopher has even had a bit of a resurgence as of late
If you don’t specify a username, your local account name will be used and thereby disclosed.
Much more seriously, if you have the ForwardAgent option enabled, the remote server can impersonate you, using your SSH agent to log into any remote server. Don’t enable ForwardAgent globally, despite its convenience, unless you have an agent that requires manual action for every action; and be exceedingly leery of using it even on trusted servers, lest the compromise of one machine allow the compromise of everything. Consider ProxyJump instead.
I think this is sufficient regardless of configuration (but don’t trust me to be correct, I haven’t verified the actual traffic or anything):
ssh -a -o PubkeyAuthentication=no [email protected]
Now of course using this will make you comparatively fingerprintable (though not identifiable) unless enough other people do it too. But then, they have your IP address, so—
If you want to skip the host key stuff, you can add `-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no`, though it’ll emit a warning about adding the host key to the known hosts file every time.
ssh whoami.filippo.iohttps://words.filippo.io/ssh-whoami-filippo-io/ and https://github.com/FiloSottile/whoami.filippo.io are useful. It suggests also adding the option IdentitiesOnly yes.
Also these https://marc.info/?l=bugtraq&m=104612710031920&w=2
I think I should write a web app that handles the SHH connection on the backend and renders the SHH app into HTML so that they can be enjoyed by the masses.
=)
wetty is another good option if you want to run a nodejs server: https://github.com/butlerx/wetty
Both use xterm.js for the client terminal, which is these days the only game in town for a web terminal (it's what VS code and many other electron apps use too). It's quite good.
Do be aware though that running a web-accessible terminal is a huge security headache. You're opening up a websocket to effectively allow commands and code to run on your server. Pay attention to security and authentication options any web terminal gives you, and use them. Most are not very secure out of the box or just following their readme examples.
And watch out as many rootkits use web terminals as payloads so smart organizations and security policies will be looking for them or their traffic and you might get a very concerned IT person asking you questions if you use these on a network or machine you don't control.