Hacker News new | past | comments | ask | show | jobs | submit
Ecco | on: Sshole
How is password auth weaker than key auth? Bugs in auth code can happen in both pathways. And apart from stupidly short passwords both should be equally impossible to brute-force.

In other words, conceptually, at the end if the day, isn’t a key just another name for a password, really?

minitech | parent | next
Password gets sent to the server. Private key does not get sent to the server, and authentication protocol can be forwarded safely, enabling things like ssh-agent, FIDO SSH keys. This is solvable with passwords (see: augmented PAKE), but `PasswordAuthentication` isn’t that. But there are also settings where none of this really matters, yes, to be fair if that’s what you’re referring to.

SSH certificates are cool too.

TZubiri | root | parent
password doesn’t get sent to the server, hash does.

but I guess that the hash is always the same unlike with pub priv key mechanism.

traceroute66 | root | parent | next
> password doesn’t get sent to the server, hash does.

Kind of irrelevant what gets sent to the server and what happens on the server.

Password is already easily defeatable long before it even leaves your computer, thanks to keyloggers and/or password manager breaches and/or old-school shoulder surfing (assisted in the 2026 era by covert filming and AI).

All of which are not vulnerabilities with hardware-backed keys which you don't even need a Yubikey for these days since most modern computers and smartphones have secure enclaves and/or TPMs. (Yubikeys are still great though).

mkj | root | parent
No, you are wrong. The password gets sent to the server. That said, I still enable passwords on servers, but don't ever share passwords between trust domains.
Borealid | parent | next
What people think of as a very strong password often has <100 "security bits" of entropy.

Keys are usually at least 128 bits of entropy, and it's easy to take them up to 256.

Yes, both are a shared secret, but password auth - even with challenge-response - is weaker than key auth exactly because key auth provides more guess resistance.

Elucalidavah | root | parent | next
But the SSH keys are based on asymmetric crypto, not shared secrets.
traceroute66 | root | parent | next
> What people think of as a very strong password often has <100 "security bits" of entropy.

The best password in the world will still be defeated by a simple keylogger or breach of your password manager.

scotty79 | root | parent
2^100 is a lot of things to try though
loading story #50379123
8organicbits | parent | next
Password reuse is the problem. The password hash is stolen from some other site and brute forced offline.
dwedge | root | parent
Same issue with key reuse. Unless you have a policy to rotate them and verify which host they login from, someone's unencrypted hard drive from 5 years ago is more likely to have a key than password.
loading story #50379595
ant0ni | parent | next
you claimed my favorite game's character name!
| parent
{"deleted":true,"id":50378887,"parent":50378857,"time":1793885697,"type":"comment"}