Re: [SAGE] The danger of SSH keys..

[Josh Smith <irilyth@infersys.com>]

I think the issue is that in many situations people can generate keys on
machines over which you don't have any control whatsoever. If I can log in
to your server from my laptop, you don't have any way to ensure that I've
put a good passphrase on my private key; whereas if I'm logging in with a
password, you can do things on the server side to ensure that I've chosen
a good one.

Then again, you can't control what I do with my excellent password; I
might write it down on a post-it stuck to my monitor, or repeat it aloud a
hundred times in the same room as my pet parrot, or put it in my profile
on MySpace, or whatever. There's only so much you can do to prevent users
from screwing up; telling them what to do, and punishing them if you catch
them not doing it, may be your best bet in many cases. (And if you can't
justify something more hardcore, like physical token based security, or
whatever.)

                                      -Josh (irilyth@infersys.com)