Hot answers tagged

11

Yes. The password is sent over the encrypted connection, but it's in plaintext to the remote server. The usual way to authenticate is for the server to calculate a hash of the password and to compare it to a value saved on the server. There are several ways of saving hashes, and with current implementations, the client doesn't know what the server uses. (...


3

If you're using password authentication, then SSH sends the password over the network. The connection is encrypted, so eavesdroppers can't see the password. The connection is authenticated, provided that you don't click blindly through a “The authenticity of … can't be established” message, so your password won't be sent to anyone except the legitimate ...


3

If you use a password based authentication scheme then, yes the password is passed over the network to the end point... But it is an encrypted channel. eg % ssh remotehost user@remotehost's password: bash$ logout In this scenario the password was sent encrypted over the network. This is why it is very important to handle known_hosts entries properly ...


2

Yes, ssh sends the password over the network, but after end-to-end encryption has been negotiated. See section 8 of RFC 4252 which says that a password authentication message contains plaintext password in ISO-10646 UTF-8 encoding [RFC3629]



Only top voted, non community-wiki answers of a minimum length are eligible