Some people may disagree with me but that&#x27;s fine. There really isn&#x27;t a correct answer here. It&#x27;s a product decision balanced with security. I think _strongly_ wanting this is mostly FUD.<p>I firmly believe in secure defaults (with all my heart) but I don&#x27;t think there&#x27;s a compelling reason to hide site names in this situation.<p>I trust the strong cryptography (and DJB) that protects the passwords and this is plenty for keeping an attacker out.<p>Yeah, it&#x27;s more information for an attacker but I don&#x27;t think it buys an attacker anything meaningful. Responding to ping or listening on specific TCP ports and responding with service banners is &quot;more information&quot; too, but these are accepted. Running your company on someone else&#x27;s computer used to not be accepted and now it is.<p>With strong cryptography there is no reason this information can&#x27;t be public. If you&#x27;re truly paranoid, you can always use a private repo or a private git server.<p>If anyone has a compelling argument for why this information should be secret by default I would love to make the change.