AFAIK unless something SSH passwords don't use any kind of PAKE or zero-knowledge. It just straight up sends it to the server after authenticating, as the pass

AFAIK unless something SSH passwords don't use any kind of PAKE or zero-knowledge. It just straight up sends it to the server after authenticating, as the password box on a website login page would. Really missed a great opportunity to add perhaps even more security than the server cert can(Because of how many users override it). Come to think of it, website logins shouldn't exist either, that's way too common and I don't see why there's no PAKE based http basic auth feature.