The admin/reports/updates/update page lists updates, and there's what looks like a handy button Download these updates at the bottom.
And then you're asked for your SSH user and password.
Now unless you're running over SSL, this is a massively daft thing to do. Provide your server credentials over plain http?
If Drupal really needs to do an SSH loopback (as the help text explains, it's highly likely that the webserver is the SSH server it will connect to) in order to run updates, then surely there ought to be a way to provide the webserver's user with a DSA key so that users don't need to pass credentials in plain text.
Is there a way? Or is this really as insecure as it looks!
(I generally use SSH and drush to do updates, but as there's a GUI there, which looks nice, I feel it ought to work)