Sofia on Nostr: the idea that password-based ssh is inherently insecure is so funny lol, it's not any ...

the idea that password-based ssh is inherently insecure is so funny lol, it's not any less secure than using a password for anything else (if anything it's actually more secure since there's a vastly lower chance of a hash/similar leak)

openssh just uses passwords as seeds for a KDF, so an n-bit password is no less secure than an n-bit key lol (well, in practical terms that is, in purely mathematical terms the possibility of collisions may decrease the security of a KDF output by an immeasurably tiny amount, but the extra computational cost of KDFs actually makes them *more* secure in other aspects, the key takeaway is that it literally just doesn't matter in practice lol)