Today I generated my first key pair, so my knowledge here is - so to speak - very limited.
On client side I am using Windows and to log in I use PuTTY and I used PuTTYGen to create the keys.
Here (https://winscp.net/eng/docs/ui_puttygen) they say:
If you leave the passphrase fields blank, the key will be saved unencrypted. You should not do this without good reason; if you do, your private key file on disk will be all an attacker needs to gain access to any machine configured to accept that key. If you want to be able to passwordless log in without having to type a passphrase every time, you should consider using Pageant so that your decrypted key is only held in memory rather than on disk.
But here I am failing to see why I should even use RSA rather than regular password authentication when I need to use the passphrase. If I do a passphrase I still need to type in a password when logging in.
On a side I would ask a question about this part:
Pageant so that your decrypted key is only held in memory rather than on disk
Does it really protect anything? I don't know how to read things from memory but isn't it a fairly common thing to do for hackers? To read/replace bits in memory?