Re:Brute-forcing a macOS user’s real name from a browser usi...
by oxygen_crisis on Thursday July 13, 2023 @07:36PM
(#36717541)
> seemingly private identifiers are SSH pubkeys (I always delete the comment trailer), which are sent to every server you SSH to and also published to places like GitHub
I use this in my .ssh/config file:
Host *
IdentitiesOnly = yes
... then you'll only send keys that are specified per-host in .ssh/config with 'IdentityFile' or with a command-line argument.More discussion: https://news.ycombinator.com/item?id=10004678
Re:Brute-forcing a macOS user’s real name from a browser usi...
by ayewo on Friday July 14, 2023 @05:25AM
(#36721488)
I've always wondered if there was any downside to having my default private keyfile being shared whenever I fail to use the "-i" option to specify the correct keyfile when authenticating against a new server.
Thanks for linking to the previous HN discussion!
Some other leaky, seemingly private identifiers are SSH pubkeys (I always delete the comment trailer), which are sent to every server you SSH to and also published to places like GitHub, and WiFi SSIDs (which are visible to any application with access to the network stack, and unfortunately aren't entirely within your control - often a list of nearby SSIDs, combined with a mapping of SSID to geolocation, is enough to triangulate your location to within a meter, which is one of many reasons I disable WiFi in favor of ethernet whenever possible).