I think you may have misunderstood the privacy hazard I’m talking about. `ssh git.charm.sh` leaks your SSH identities, which is akin to announcing “Hi, I’m gaun

I think you may have misunderstood the privacy hazard I’m talking about. `ssh git.charm.sh` leaks your SSH identities, which is akin to announcing “Hi, I’m gauntletwizard on GitHub” (and quite possibly “I work for ACME Corporation”) by merely connecting, which is not something people are generally aware of or expect (that’s why I pointed it out). This allows for perfect tracking, and such tracking can easily support various nefarious actions. By contrast, HTTP only allows comparatively generic fingerprinting via things like your IP address and user agent characteristics, though certainly in some circumstances it can be possible to identify a user uniquely from these—but you’ll have to work at least a bit for it. More generally, over HTTP if someone wants to know that you’re gauntletwizard on GitHub, they’ll have to go via a GitHub OAuth flow, where you get told they want to know your account name, public email address, whatever, and you get to decide whether to allow this.