Hacker News new | past | comments | ask | show | jobs | submit
traceroute66 | on: Sshole
To be fair, I have less than zero sympathy for anyone who runs SSH on any platform without `PasswordAuthentication=no` in 2026.

Its not asking for trouble, it is there will be trouble, not if but when.

As for the people who say "well, I run SSH on port 942329053052". Well guess what, the bots make short work on that. We tried it at $work as an experiment, multiple bots found it in less than a couple of hours. That's why your SSH config must be hardened, preferably running on a hardened OS too.

dwedge | parent | next
> Its not asking for trouble, it is there will be trouble, not if but when.

Did any of those bots brute force a password? Because a 20 character random password is comparable in brute force complexity to an SSH key. The experiment you ran was just as valid for SSH keys on that port, and had no bearing on password vs key.

loading story #50379267
Ecco | parent | next
How is password auth weaker than key auth? Bugs in auth code can happen in both pathways. And apart from stupidly short passwords both should be equally impossible to brute-force.

In other words, conceptually, at the end if the day, isn’t a key just another name for a password, really?

minitech | root | parent | next
Password gets sent to the server. Private key does not get sent to the server, and authentication protocol can be forwarded safely, enabling things like ssh-agent, FIDO SSH keys. This is solvable with passwords (see: augmented PAKE), but `PasswordAuthentication` isn’t that. But there are also settings where none of this really matters, yes, to be fair if that’s what you’re referring to.

SSH certificates are cool too.

TZubiri | root | parent
password doesn’t get sent to the server, hash does.

but I guess that the hash is always the same unlike with pub priv key mechanism.

loading story #50378996
loading story #50379219
loading story #50379615
loading story #50378887
kccqzy | parent | next
I run SSH with password authentication on but the port binds to a ULA address. It’s fine. No need to be so absolutist.
loading story #50379236
znnajdla | parent | next
This particular bug works even with password authentication turned off.
loading story #50378804
loading story #50378820
loading story #50378754
ghm2180 | parent | next
100% and with local tool calls many AI systems will do ssh "for you" and end run around any security theatre that you may have going on with LLMs.
loading story #50379926