Re:A ssh server that knows who you are. $ ssh whoami.filippo.io
by pseudohadamard on Sunday January 04, 2026 @11:56PM
(#46495468)
It's an artefact of OpenSSH braindamage, like a WiFi device spraying probe requests OpenSSH sprays all of your keys to any server it connects to and then takes whatever the server responds with as the one to auth. There's a CVE for this, CVE-2016-20012, but the OpenSSH maintainers rejected it as by-design, https://github.com/openssh/openssh-portable/pull/270.
[ Parent
| on HN ]
Re:A ssh server that knows who you are. $ ssh whoami.filippo.io
by FiloSottile on Monday January 05, 2026 @08:10AM
(#46498374)
If that PR were merged, whoami.filippo.io would still work the same. It would just receive signed requests instead of queries.