[scott_karana]

> This data is also, I'm 99% sure, transmitted in plaintext

I was curious about this, so I did some research.

First, if you run `ssh -v`, you can see that there's a key exchange (eg, Diffie-Hellman), then a cipher and MAC are negotiated, and only once you get to the user authentication portion do your public keys get sent to the server.

So, only Alice and Bob can see the public keys: not Mallory.

Further reading: SSH transport layer, https://tools.ietf.org/html/rfc4253

[openasocket]

Ah yes, you're right! I remembered there is some stuff transmitted in plaintext at the beginning, but it's just the normal SSL cipher-suite negotiation.