It is a common knowledge, that using keys to authenticate ssh users is more secure than using passwords. However, even with password login disabled, when running ssh-copy-id I am still asked for user's password. It makes me think - what stops the attacker from trying to brute force this password instead (and upload self-generated public key to gain permanent access)? Is it a security hole, or am I missing something important?
P.S. let's assume there is no fail2ban or similar software running