Ask HN: Are SSH keys with passphrases considered 2FA?

2 h43z 1 8/22/2025, 10:17:05 AM

It could be argued that from the servers perspective only one thing was provided, so it's not 2FA.

Then what about ssh keys AND user/password authentication?

Like this sshd_config

  PasswordAuthentication yes
  PubkeyAuthentication yes
  AuthenticationMethods publickey,password

I guess it boils down to if one thinks ssh keys are something you know or something you have? The passphrase and password is very clearly something I know.

I'd like to hear your thoughts.

Comments (1)

theandrewbailey · 5h ago

If the server login needs a key and password (separate from the password to encrypt your private key), yes that's two factor: the server sees something you know and something you have. I worked on a platform (Salesforce B2C Commerce Cloud) that sometimes used WebDAV with HTTP basic auth and HTTPS client certificates (combined), and that was considered two factor authentication. I don't see how that's totally different from this SSH setup.

FFmpeg 8.0 (ffmpeg.org)

Io_uring, kTLS and Rust for zero syscall HTTPS server (blog.habets.se)

LabPlot: Free, open source and cross-platform Data Visualization and Analysis (labplot.org)

Launch HN: Inconvo (YC S23) – AI agents for customer-facing analytics

Making LLMs Cheaper and Better via Performance-Efficiency Optimized Routing (arxiv.org)

DeepSeek-v3.1 (api-docs.deepseek.com)

What about using rel="share-url" to expose sharing intents? (shkspr.mobi)

Thunderbird Pro August 2025 Update (blog.thunderbird.net)

Everything is correlated (2014–23) (gwern.net)

Control shopping cart wheels with your phone (2021) (begaydocrime.com)

All managers make mistakes; good managers acknowledge and repair (terriblesoftware.org)

VHS-C: When a lazy idea stumbles towards perfection [video] (youtube.com)

Code formatting comes to uv experimentally (pydevtools.com)

Go is still not good (blog.habets.se)

Vibe Debugging: Enterprises' Up and Coming Nightmare (marketsaintefficient.substack.com)

An interactive guide to SVG paths (joshwcomeau.com)

How Not to Buy a SSD (andrei.xyz)

Weaponizing image scaling against production AI systems (blog.trailofbits.com)

4chan will refuse to pay daily online safety fines, lawyer tells BBC (bbc.co.uk)

Crimes with Python's Pattern Matching (2022) (hillelwayne.com)

From GPT-4 to GPT-5: Measuring progress through MedHELM [pdf] (fertrevino.com)

How does the US use water? (construction-physics.com)

1981 Sony Trinitron KV-3000R: The Most Luxurious Trinitron [video] (youtube.com)

Building AI products in the probabilistic era (giansegato.com)

Show HN: OS X Mavericks Forever (mavericksforever.com)

AWS CEO says using AI to replace junior staff is 'Dumbest thing I've ever heard' (theregister.com)

How well does the money laundering control system work? (journals.uchicago.edu)

Being “Confidently Wrong” is holding AI back (promptql.io)

Text.ai (YC X25) Is Hiring Founding Full-Stack Engineer (ycombinator.com)

My other email client is a daemon (feyor.sh)

Beyond sensor data: Foundation models of behavioral data from wearables (arxiv.org)

Using Podman, Compose and BuildKit (emersion.fr)

AI tooling must be disclosed for contributions (github.com)

Privately-Owned Rail Cars (amtrak.com)

Elegant mathematics bending the future of design (actu.epfl.ch)

Miles from the ocean, there's diving beneath the streets of Budapest (cnn.com)

Benchmarks for Golang SQLite Drivers (github.com)

The AI Job Title Decoder Ring (dbreunig.com)

Skill issues – Dialectical Behavior Therapy and its discontents (2024) (thedriftmag.com)

Show HN: Ultra-fast, embedded KV store in pure Rust (github.com)

Mark Zuckerberg freezes AI hiring amid bubble fears (telegraph.co.uk)

Philosophical Thoughts on Kolmogorov-Arnold Networks (2024) (kindxiaoming.github.io)

Show HN: Splice – CAD for Cable Harnesses and Electrical Assemblies (splice-cad.com)

Why is D3 so Verbose? (theheasman.com)

Scientists No Longer Find X Professionally Useful, and Have Switched to Bluesky (academic.oup.com)

Launch HN: Skope (YC S25) – Outcome-based pricing for software products

The power of two random choices (2012) (brooker.co.za)

D4D4 (nmichaels.org)

Epson MX-80 Fonts (mw.rat.bz)

SK hynix dethrones Samsung as world’s top DRAM maker (koreajoongangdaily.joins.com)

Ask HN: Are SSH keys with passphrases considered 2FA?

Comments (1)