5 ms·

"Public keys" are supposed to be public anyway, isn't that what it's designed for? I see no harm

• userbinator 11y ago
  Using the same public key on two sites is like using the same username - something that you would do only if you want your identity linked between those sites. It's also a much stronger proof of identity than having the same username, because that's what they were designed for.
  • baby 11y ago
    So don't use the same public key on two different site
• gojomo 11y ago
  Not necessarily. The "public" in "public key" is not an announcement of intended global availability, but rather role in contrast to "private key". There are many reasons people or systems might want to keep "public keys" obscured or pseudonymous. Still, many probably don't mind the public disclosure of Github account public keys. But, the more serious issue here goes beyond that. In an unexpected and likely unintended way, one's Github identity is revealed to a third party, along with your origin IP and quite possibly other SSH keys used with other systems. It's that set of mappings – IP <-> Github identity <-> other identities – that violates expectations.