SSH doesn&#x27;t get this right. It&#x27;s no better than a (auto-pinned) self-signed cert, in our world.<p>I challenge everyone to find in their extended group of friends and colleagues, and their friends and colleagues, a single person who consistently checks the fingerprint* on every first SSH connection.<p>Id personally have a hard time finding someone who even knows it matters.<p>And if you don&#x27;t? Mitm can get your password, or tunnel your key to another host, bar some crazy ~&#x2F;.ssh&#x2F;config which nobody has.<p>WiFi&#x27;s WPA2 actually does this better than SSH; the passphrase authenticates both parties to eachother, not just one way. I can&#x27;t set up a hotspot with your home SSID and intercept your PSK---even on initial connection.<p>SSH: nice in a cryptographic utopia, not better than self signed SSL certs when applied to human beings.<p>SSH is just not suitable for humans. Apparently.<p>* a significant part of it, not just the security-through-obscurity random 2 letters in the middle and the last four.