Hot answers tagged

11

Yes. The password is sent over the encrypted connection, but it's in plaintext to the remote server. It has to be, really, because the usual way to authenticate is to calculate a hash of the password and to compare it to a value saved on the server. There are several ways of saving hashes, and the client can't know what the server uses. (see e.g. the crypt ...


3

If you use a password based authentication scheme then, yes the password is passed over the network to the end point... But it is an encrypted channel. eg % ssh remotehost user@remotehost's password: bash$ logout In this scenario the password was sent encrypted over the network. This is why it is very important to handle known_hosts entries properly ...


2

Yes, ssh sends the password over the network, but after end-to-end encryption has been negotiated. See section 8 of RFC 4252 which says that a password authentication message contains plaintext password in ISO-10646 UTF-8 encoding [RFC3629]


1

SSH does send the userid and password over the network in plain text inside an encrypted channel. This is why when you connect a new host you get prompted to accept the key. In the case of a man-in-the-middle attack with a known host, SSH will refuse to connect until you remove the old key. The plain text password is available at the end points, your ...



Only top voted, non community-wiki answers of a minimum length are eligible