If you don’t specify a username, your local account name will be used and thereby disclosed.

Much more seriously, if you have the ForwardAgent option enabled, the remote server can impersonate you, using your SSH agent to log into any remote server. Don’t enable ForwardAgent globally, despite its convenience, unless you have an agent that requires manual action for every action; and be exceedingly leery of using it even on trusted servers, lest the compromise of one machine allow the compromise of everything. Consider ProxyJump instead.

I think this is sufficient regardless of configuration (but don’t trust me to be correct, I haven’t verified the actual traffic or anything):

  ssh -a -o PubkeyAuthentication=no [email protected]

Now of course using this will make you comparatively fingerprintable (though not identifiable) unless enough other people do it too. But then, they have your IP address, so—

If you want to skip the host key stuff, you can add `-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no`, though it’ll emit a warning about adding the host key to the known hosts file every time.

    ssh whoami.filippo.io

https://words.filippo.io/ssh-whoami-filippo-io/ and https://github.com/FiloSottile/whoami.filippo.io are useful. It suggests also adding the option IdentitiesOnly yes.

0: https://www.cloudflare.com/teams/browser-isolation/

Also these https://marc.info/?l=bugtraq&m=104612710031920&w=2