Password-based authentication is a login method in which a user proves their identity by entering a secret password. It is simple and widely supported, but passwords can be guessed, reused, phished, or captured when users enter them into a fake login service. In an SSH connection, encryption protects credentials in transit to the intended server; it does not help if a user is diverted to an impostor and accepts its identity.
Attackers may exploit deceptive websites, compromised routes, or fake servers to collect passwords. Defenses include verifying server identity, using unique strong passwords with rate limits, and enabling multi-factor authentication. For sensitive SSH access, public-key authentication can reduce reliance on passwords, though keys and server host identities must also be protected and verified.