The parent is discussing both, and I am too; specifically, the parent says,<p>&gt; <i>we&#x27;re not allowed to use key auth.</i><p>i.e., they&#x27;re using password based auth.¹ The point of my post is that while certainly users leaving the private key unencrypted isn&#x27;t good, trading that for password auth leaves you in a worse state overall (IMO).<p>¹Of course, they could be using an auth scheme that is neither password nor key based. But given that the parent didn&#x27;t come out and <i>say</i> that, my gut says that&#x27;s not the case here.