> > Because a 20 character random password is comparable in brute force complexity to an SSH key.

> You can't be serious with your comment. \n\n No its not.

If you differ in opinion, maybe provide evidence? Especially for a claim like long randomly generated value 1 being absurdly ("can't be serious"-level) weak as compared to long randomly generated value 2

If you mean it's log(62^20,2)≈119 bits of entropy instead of 128+ and so it's theoretically weaker when we build a Dyson sphere around the sun to brute force that key (after somehow obtaining the shadow file, since an online attack would be way too slow), then sure

Other points are fine, but why do you say a 20-character random password isn’t comparable in brute force complexity to an SSH key?

> The point is that security by obscurity does not work in 2026.

I feel the opposite, note how most all AI vulns discovered use source code level analysis, empirically keeping source code hidden is more secure.

kerchoff’s principle is misconstrued by a voyeuristic internet that wants to see source code