4 ms·
Makes you wonder: why do people still use password authentication with SSH?
by pipo234 3y ago
Makes you wonder: why do people still use password authentication with SSH?
- eppp 3y agoWhen I ssh to a device it asks me for a user name and password. Thats probably why.
- PartiallyTyped 3y agoThey are saying, "why don't you use public key cryptograph to create an identity on the remote machine?".
- eppp 3y agoI dont see that option when I ssh to a machine. If you want better defaults then offer them. I was being deliberately obtuse but barely.
- silviot 3y agoI recommend you do set up key authentication. You'll get more convenient logins and better security. This page should document how to do it: https://www.ssh.com/academy/ssh/copy-id https://www.ssh.com/academy/ssh/copy-id
- numpad0 3y agoI suppose what the parent is saying is that's not the default. Fresh install of anything is still password and GitHub key import isn't a panacea.
- PartiallyTyped 3y agoI don't see how ssh-copy-id has anything to do with Github.
- Aachen 3y agoWhich is commonly deployed via password authentication
- waitwhatwhoa 3y agoPasswords are sent all at once from the client to the server. This feature is for obfuscating your keystroke timing within the encrypted connection.
- greggsy 3y agoFor 40% of global use cases there’s probably probably little to no risk. The rest is probably a mix of good, bad, ‘just enough’.
- ot 3y agoEven if you don't use password authentication you may still type sensitive information in a SSH session. For example, password when using sudo.
- PartiallyTyped 3y agoOr any form of authentication for that matter, e.g. AWS.
- deleted 3y ago[deleted]
- simias 3y agoHow else would I upload my public key?
- SoftTalker 3y agoA service may provision an account with a provided ssh public key, so that you never log in with a password, even once. It's sort of a chicken-egg problem though, presumably you do have a password somewhere along the line, such as in a portal where you created your account and uploaded your public key.
- alexvitkov 3y agoI'd say there are more valuable things you can do to improve security than solving the problem of "having to ssh in with a password one time to upload a key"
- SoftTalker 3y agoMaybe. Not having a password on the server eliminates all the risks associated with weak or leaked passwords. And then you can configure SSH to reject password logins altogether. It's not an insignificant benefit.
- hnfong 3y agoI'd say there are more valuable things you can do to improve security than solving the problem of "having to ssh in with a password one time to upload a key, then updating the config to reject password logins".
- hedora 3y agoIf you can't securely ship a public key to a fresh machine, then how can you trust the software running on that machine?
- alexvitkov 3y ago
- PrimeMcFly 3y agoConvenience. Keys are more work.
- GhostWhisperer 3y agohow are keys more work vs password?
- PrimeMcFly 3y agosomething-you-know auth is generally less work than something-you-have auth, since you need to ensure you always have the key handy whenever you would want to log on.
- Vicinity9635 3y ago[dead]
- fulafel 3y agoA central aim of of SSH is confidentiality. There's a lot besides passwords that you can deduce with traffic analysis, especially if you can correlate with other observed events.
- ilyt 3y agoFor real; you can even make sudo work with SSH_AGENT. Add hardware key and it's pretty nice setup.
- djmdjm 3y agoThis is irrelevant for SSH password authentication. The obfuscation is for the session _after_ authentication.