I came across this old paper, discussing the possibility of password length information being disclosed when usin SSH: Timing Analysis of Keystrokes and Timing Attacks on SSH. The paper has been discussed here before .
This made me wonder: should entering passwords over SSH generally be avoided? If that's the case, wouldn't it be preferable to connect as a privileged user (using a ssh key) than to connect as an unprivileged user and then successively sudo into the root account? Using the former method, no password would be transfered, while with the latter, it might be possible to guess the password. Even if ssh is configured to allow password-less login only, this could be used to read/send mails or access whatever other service is available to the user.
Is this sound reasoning? Did I get a premise wrong somewhere?