Auth

HTTP Basic authentication places an encoded username and password in an Authorization header. The encoding is reversible, so possession of that header can be equivalent to possession of the credential. Basic defines a challenge-response exchange, but it does not cryptographically bind a response to a fresh server nonce. A captured accepted value can be replayed while the server continues to accept that account and credential. ...

SSH keys are convenient, and convenience is exactly why they get out of hand. The practical discipline is not to generate fewer keys; it is to make each key a named identity with a clear scope, a short lifetime, and a record in the files that tell an auditor who is allowed to do what. ...