That'd only apply if they're using very long, random passwords. For a 128-bit hash that'd be at least ~20 chars using the entire keyboard, and over 22 if alphan

That'd only apply if they're using very long, random passwords. For a 128-bit hash that'd be at least ~20 chars using the entire keyboard, and over 22 if alphanumeric only. Your docs mention SHA256/512, so double or quad those. If your attacker is able to "figure out" 128-bit+ passwords, then you've probably got other problems. And if the point of using passwords is for emergency logins from phones, I'm not sure how useful a 80 char pass is. Might as well keep the ssh key saved somewhere and type it in eh?