OpenSSH sshd enforces mode
StrictMode is enabled. How is mode
0644 more vulnerable?
sshd_config man page says
Specifies whether sshd(8) should check file modes and ownership of the user's files and home directory before accepting login. This is normally desirable because novices sometimes accidentally leave their directory or files world-writable. The default is yes. Note that this does not apply to ChrootDirectory, whose permissions and ownership are checked unconditionally.
I believe this refers not to
~/.ssh/authorized_keys but rather to
~/.ssh itself, which typically contains your private keys. With
~/.ssh set to mode
drwx------), nothing inside it can be accessed by other users (except root). This happens to mean
authorized_keys itself cannot be world-readable (unless you use the
AuthorizedKeysFile config item to specify another location).
The risks to a publicly-visible
~/.ssh/authorized_keys file are pretty minimal but do exist: if you have compromised keys (the attacker has access to them) or keys that are weak (e.g. low bit size or old cryptosystem), an attacker might be able to replicate or use those keys and this file might tell them which system(s) to try them on.
Consider CVE-2008-0166, a bug in Debian's OpenSSL build's random number generator. Debian had to create the openssh-blacklist package as a short-term solution to ensure the weak keys could be weeded out.
One of the principles of information security is to restrict permissions and privileges as much as possible. Under this principle, only the minimum necessary permissions and privileges are granted to users, files, processes, etc.
StrictMode applies this principle.
The reason for this principle is to reduce the chances of giving an attacker something that could be useful to him/her. In this case, an attacker that has read access to
authorized_keys would be able see other hosts are able to connect to this host. Knowing this information, the attacker could then look for ways to breach one of these other hosts, in order to gain access to this host. The philosophy here is - why give the attacker something that he/she may be able to use, when there is nothing to be gained by doing so?