The first time I connect via SSH, a "fingerprint" appears. How can I be sure that it belongs to my server/router/etc. and has not been tampered with by a fraudster (MITM)?
For example, for key-based authentication, I decide to send the public key to the remote router.
ssh-copy-id -f firstname.lastname@example.org < /dev/null
In response, the router gives me a "fingerprint" to confirm. BUT the "man in the middle" might as well query the router and get the same fingerprint and then forward it to me as if it were a real router. I then send the public key and establish a connection to it and it to my router.
How does a "fingerprint" protect against MITM?