Sick of smug “well you should be using certificates*, not passwords” reply guys today. A proper password has plenty enough entropy to protect against brute forcing, so it comes down to whether the server has an auth bug in its password code or its certificate code, and I’ve seen both plenty of times.

* SSH keys are certificates.