MOmodinfo·Jan 4, 2026Submission
A ssh server that knows who you are. $ ssh whoami.filippo.io
44 points · Open discussionFiloSottile
whoami.filippo.io
Go2015–2026
FiloSottile / whoami.filippo.io
whoami.filippo.io
A ssh server that knows who you are. $ ssh whoami.filippo.io
18Distinct people
20Mentions
0Explicit recommenders
2.4KGitHub stars
What to know before exploring
What it is
A ssh server that knows who you are. $ ssh whoami.filippo.io
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year20 dated mentions
Observed mentions: 2015-08-04 17:46:42 UTC to 2026-01-04 20:18:01 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 7 | 0 | 7 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
20 sourcesFor a little more context and a PoC illustrating the matter: https://github.com/FiloSottile/whoami.filippo.io?ref=words.f...
In Show HN: Shhhbb, an SSH BBSJust for those curious about it:
$ ssh whoami.filippo.io
+---------------------------------------------------------------------+
| |
| _o/ Hello! |
| |
| |
| Did you know that ssh sends all your public keys to any server |
| it tries to authenticate to? You can see yours echoed below. |
| |
| We tried to use them to lookup your GitHub account, |
| but got no match :( |
|
Read the rest
|
| -- Filippo (https://filippo.io) |
| |
| |
| P.S. The source of this server is at |
| https://github.com/FiloSottile/whoami.filippo.io |
| |
+---------------------------------------------------------------------+
Of course, this happens because the day I learned about the default behavior of SSH (to send all your keys in hope that one works), I went ahead to disable it to stop remote servers from being able to inspect all my keys. I feel this can be abused in a similar way that sites abuse browser information to fingerprint users. So I put this at the bottom of ~/.ssh/config:
Host *
IdentitiesOnly yes
And then I explicitly indicate what key to use for each server, either with the "-i" argument, or adding entries above the previous lines:
Host example.com
IdentityFile ~/.ssh/example.com.pem
Other commenter mentioned that something similar can be achieved with "PubkeyAuthentication no", but I've been using "IdentitiesOnly yes" for years without issue.
Public keys are identity, so, a remote server can (and a famous one does: https://github.com/FiloSottile/whoami.filippo.io) tell you if e.g. you connect to it while offering to prove your identity with keys github knows about, because github provides a list of those keys. That's the extent of the interesting consequences of knowing your public keys.
You can't realistically MITM SSH because you will have a session mismatch. You may be able to convince a naive visitor (coming to some.machine.example with no prior contact, and not using either certificates, or secure DNS protected credentials to verify the identity of the machine) that you're some.machine.example but you can't successfully splice this to a connection with the real some.machine.example if they use public key login.
The reason is, during connection you persuaded the client tha
Read the rest
t you are some.machine.example, but to do that you needed to make up keys since you don't know the real keys for some.machine.example. However the real some.machine.example does know its keys and they're different. The credentials the victim client gives you only work for your keys, they won't work for the real some.machine.example keys, and the client has no reason to present you with credentials that would work for the real some.machine.example, so you can't authenticate to the real some.machine.example as them.
Ah, good, thanks. Unfortunately, whoami.filippo.io is not resolving.
https://words.filippo.io/ssh-whoami-filippo-io/ and https://github.com/FiloSottile/whoami.filippo.io are useful. It suggests also adding the option IdentitiesOnly yes.
In Charm – Tools to make the command line glamorousIt's one of those tricks that's not super well known but a decent few know it - The Ubuntu server installer will ask if you want to import your ssh keys from Github, for example, and there was a Show HN[1] with a cool trick[2] that took advantage of this information.
[1]https://news.ycombinator.com/item?id=10004678
[2]https://github.com/FiloSottile/whoami.filippo.io
In Sign arbitrary data with your SSH keys> Did you know that ssh sends all your public keys to any server it tries to authenticate to? You can see yours echoed below.
Github: https://github.com/FiloSottile/whoami.filippo.io
In ssh whoami.filippo.ioIf a bad guy gets root on one server you're currently connected via ssh with, and forwarding said key via, they can also access (unless otherwise firewalled) all systems that ssh key grants them access to.
See also: https://github.com/FiloSottile/whoami.filippo.io
Using a private key per system or set of systems means that such an attacker would only gain access to what that key grants them access to.
My "github" key only grants access to my github repos, not to my bitbucket repos or to my DigitalOcean servers, or my Scaleway servers.
I have an SSH key for each "thing", and each key is kept in a different keyring via https://github.com/ccontavalli/ssh-ident, _precisely_ to avoid that problem.
As an example, an attacker gaining root on my Oracle Cloud free server will not be able to clone all my Github repos with it: I only use that key to
Read the rest
connect to that server, and while I may have the github key unlocked at the same time - that's on a different keyring which the server has no visibility of.
This may be what you get:
+---------------------------------------------------------------------+
| |
| _o/ Hello! |
| |
| |
| Did you know that ssh sends all your public keys to any server |
| it tries to authenticate to? You can see yours echoed below. |
| |
| We tried to use that to find your GitHub username, but we |
| couldn't :( maybe you don't even have GitHub ssh keys, do you? |
|
Read the rest
|
| By the way, did you know that GitHub publishes all users' |
| ssh public keys and Ben (benjojo.co.uk) grabbed them all? |
| |
| That's pretty handy at times :) But not this time :( |
| |
| |
| P.S. This whole thingy is Open Source! (And written in Go!) |
| https://github.com/FiloSottile/whoami.filippo.io |
| |
| -- @FiloSottile (https://twitter.com/FiloSottile) |
| |
+---------------------------------------------------------------------+
+---------------------------------------------------------------------+
| |
| _o/ Hello! |
| |
| |
| Did you know that ssh sends all your public keys to any server |
| it tries to authenticate to? You can see yours echoed below. |
| |
| We tried to use that to find your GitHub username, but we |
| couldn't :( maybe you don't even have GitHub ssh keys, do you? |
| |
| By the way,
Read the rest
did you know that GitHub publishes all users' |
| ssh public keys and Ben (benjojo.co.uk) grabbed them all? |
| |
| That's pretty handy at times :) But not this time :( |
| |
| |
| P.S. This whole thingy is Open Source! (And written in Go!) |
| https://github.com/FiloSottile/whoami.filippo.io |
| |
| -- @FiloSottile (https://twitter.com/FiloSottile) |
| |
+---------------------------------------------------------------------+
Wrong solution.
The main problem that Fhilippo pointed out with the service is that ssh by default gives all keys present inn your keyring, or all keys named id_{rsa,dsa,ecdsa}. What should be done is to never present ALL your keys, but turn on "IdentitiesOnly yes" in your SSH config.
Project: https://github.com/FiloSottile/whosthere
In Ask HN: How do you manage SSH keys and SSL certificates in your company?Whosthere – An ssh server that knows who you are
1 points · Open discussionDouble-reading the man page I noticed that IdentitiesOnly makes ssh only send IdentityFile keys, however IdentityFile has a default of "~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa".
The result is that with this configuration you would still send id_rsa to unknown hosts.
You also need to add "PubkeyAuthentication no" to your global stanza, and re-enable it for good hosts.
# Ignore ssh-agent keys
IdentitiesOnly yes
# Disable public key authentication
PubkeyAuthentication no
# Send your public key to github only
Host github.com
PubkeyAuthentication yes
IdentityFile ~/.ssh/id_rsa
More instructions: https://github.com/FiloSottile/whosthere#how-do-i-stop-it
In Show HN: My SSH server knows who you areExactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name.
(And if you have agent forwarding active I show you a big WARNING [0].)
There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3].
[0] http://git.io/vOVYm
[1] https://github.com/FiloSottile/whosthere
[2] https://github.com/FiloSottile/whosthere/blob/master/src/ssh...
[3] https://news.ycombinator.com/item?id=10005169
In Show HN: My SSH server knows who you areShowing the 15 most recent of 20 sources. Enable JavaScript to search and browse every indexed mention.