This question already has an answer here:
I'm certainly not saying this is a "good idea," and I always disable password authentication on SSH servers. However, the question came up when talking to a friend: If your password is as long and random as your private SSH key, is there a security difference with logging in with your long password vs. your private key?
My intuition is that the password is less secure because you need to transmit it "over the wire" for the server to authenticate. Whereas your private key stays on your computer, and you only send a calculation of public_key*private_key to the remote server. But then, the remote server has your public key... so is it any better?
Theoretically, brute forcing a 2048 bit password (with proper entropy) should be exactly as difficult as brute forcing a 2048 bit private key, correct?