An SSH server that identifies users by enumerating their public keys and matching them against GitHub's public key dataset.
whoami.filippo.io is an SSH server that identifies users by enumerating their SSH public keys during authentication and matching them against a public dataset of GitHub user keys. It demonstrates how SSH servers can capture all public keys a client presents and use them to discover the user's identity via GitHub's API.
Developers, security researchers, and system administrators interested in SSH authentication mechanics, privacy implications, and educational security demonstrations.
It provides a hands-on, harmless way to understand how SSH public key authentication can leak user identity information, serving as both an educational tool and a privacy awareness demonstration.
A ssh server that knows who you are. $ ssh whoami.filippo.io
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The server enumerates all public keys presented by SSH clients during authentication, as detailed in the README's 'How it works' section, effectively illustrating a privacy risk.
It matches keys against Ben Cox's public dataset of GitHub keys and uses the GitHub API to retrieve user names, providing realistic identification based on actual data.
Uses keyboard-interactive authentication without sending challenges, ensuring a smooth, user-friendly demonstration without requiring input, as explained in the implementation.
Serves as a hands-on tool to understand SSH mechanics and encourage better configuration practices, aligning with the project's philosophy on privacy implications.
Purely a demonstration server; it lacks essential SSH features like shell access or data transfer, making it unsuitable for any real-world use beyond education.
Relies on Ben Cox's dataset and GitHub API, which could become outdated or fail, potentially breaking the identification functionality without warning.
To mitigate the demonstrated risk, users must edit SSH config files with specific directives, which can be error-prone and confusing for less experienced users, as shown in the 'How do I stop it?' section.