Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true.
Let's say we have the following variables for this example:
- The SSH Server is publicly accessible
- The SSH Server has fail2ban and will perma-ban any ip that tries to ssh to root or fails more than 3 times.
- Users have Full Disk Encryption on all devices using SSH
- The SSH Server requires two factor authentication from a authy on an android device with FDE
- Users are using complex 48 character passwords for FDE (ex: YUba3KR06/62.Dzq!955513s0k2m123;sF32a60G6n2PYu0Z8_vv8u) with the guarantee of not writing them down
Which would of the following would truly be more secure?
- Users use memorized passwords (not written down) for SSH. All passwords would be complex with 16+ characters (ex: S_s7vEn93z0!.Lid)
- Users use Passowrdless SSH Keys