3 ms·

Does this mean it's safer to authenticate using public-private keys (SSH) than passwords (SSH, HTTP)?

• woodrowbarlow 7y ago
  i think it's fair to say that asymmetric keypair authentication is more secure than passwords in general.
  • tialaramex 7y ago
    Asymmetric PAKEs level the playing field considerably. The way we typically use passwords (you just outright tell the other party the password and we hope that's fine) is terrible security design. But everything about passwords is pretty terrible, their only "benefit" is that they're easy which is often undone by measures layered on top to try to deliver security, such as password rotation policies. But this was still a dumb bug.