I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers with passwords, while I prefer to log into a system without having to enter a password every time.
They fear that it is not secure to connect without a password. What should I tell them? For me, passwords are bad because they could be brute-forced or captured with a keylogger.
I use the
ssh-copy-id tool to copy my public key to the server. I then simply connect with
ssh servername. In fact, I only have to enter the password for my private key once every time my system boots. If my workstation runs for 3 days, I never have to enter the password again, which they say is insecure. Is that true? I know that keys are better, but I don't know how to explain that to them.