Security of ssh across a LAN, public key versus password

[Stuart Henderson]

On 2024/10/22 09:14, Chris Green wrote:
> I have been looking at this security question with a sort of 'tunnel
> vision', I'm concerned with login security of remote systems **when
> viewed from my desktop**.  For this specific case, i.e. when someone
> is sitting at my desk, or has my laptop in front of them, there is
> little to choose between password and public-key authentication.

Also consider the case of connecting to a malicious remote host. Either
a totally illegitimate host where you don't have a known_hosts entry or
fingerprint to check, or where a "good" host has been compromised.

With public keys, your password is not sent to the remote system.

With passwords, a modified sshd could log your password (avoiding any
need to brute-force the hash from the password database).