Why?

Adding a passphrase to an SSH key enhances security by protecting your private key from unauthorized use.

Here are the key reasons why adding a passphrase is beneficial:

Protection against unauthorized use

A passphrase adds an extra layer of security to your SSH key. Without a passphrase, anyone who gains access to your computer could potentially copy your private key and use it to access servers or services that trust the corresponding public key. This could include family members, coworkers, system administrators, or even hostile actors.

Security in case of compromise or stolen laptop.

If your computer is compromised, a secure passphrase helps keep your private key from being copied and used by unauthorized individuals. This is crucial because once a private key is compromised, it can be used to access any system or service that trusts the corresponding public key.

Temporary Passphrase Caching

While the downside of using a passphrase is that you need to enter it every time you create a connection using SSH, you can mitigate this inconvenience by using ssh-agent to temporarily cache your passphrase. This way, you don't have to enter it every time you connect, making the process more convenient while still maintaining a high level of security.

Debates about the need to use a Passphrase

Some argue that there's no loss in security by not having a passphrase on your key, as the security of the key itself becomes paramount. However, this viewpoint assumes that the key is stored securely and that the environment in which it's stored is secure. If the key is compromised, a passphrase would not prevent its use. Therefore, the decision to use a passphrase should be based on the security of the key's storage and the sensitivity of the data or services it protects.

TL;DR; adding a passphrase to an SSH key is a security best practice that helps protect your private key from unauthorized use, especially in scenarios where your computer might be compromised. While it introduces a minor inconvenience by requiring you to enter the passphrase for each SSH connection, using ssh-agent can alleviate this issue.