↓ Skip to main content

“The first is that the SSH protocol provides to the server all public keys the client is willing to produce signatures for, which by default are all the public keys in your ssh-agent and in your ~/.ssh/id_* .”

Filippo Valsordawords.filippo.io ↗

Connect to an SSH server and your client hands over every public key you have. GitHub publishes everyone’s keys, and its GraphQL API returns 100 users per request. Valsorda walked all 97,616,627 GitHub users in under a couple of weeks without hitting a rate limit. The lookup table is under 400MB. Any server that builds the same table learns your GitHub name the moment you connect.