but the attacker can't make arbitrary new sessions, because they don't get your private key.
unless the attacker takes over the session to allow its own public key, or just password auth.
but the attacker can't make arbitrary new sessions, because they don't get your private key.
unless the attacker takes over the session to allow its own public key, or just password auth.