How to update Drupal securely using GUI/web interface The admin/reports/updates/update page lists updates, and there's what looks like a handy button Download these updates at the bottom.

And then you're asked for your SSH user and password.

Now unless you're running over SSL, this is a massively daft thing to do. Provide your server credentials over plain http?

If Drupal really needs to do an SSH loopback (as the help text explains, it's highly likely that the webserver is the SSH server it will connect to) in order to run updates, then surely there ought to be a way to provide the webserver's user with a DSA key so that users don't need to pass credentials in plain text.

Is there a way? Or is this really as insecure as it looks!

(I generally use SSH and drush to do updates, but as there's a GUI there, which looks nice, I feel it ought to work)
I think you are right that it's asking you to enter your important credentials over a potentially non-encrypted channel. This feature is a trade-off between doing things an optimally secure way and making it easy to get updates done. If updates are hard to do people won't do them and that is also an insecure situation.

Entering your credentials over a non-encrypted channel is only insecure if you think someone is sniffing your traffic. You can mitigate that by using a vpn or ssh tunnel (especially one that goes to the server). 

Your idea to upload your private ssh key to the webpage to avoid using credentials seems at least partially flawed to me: the private key has the same value to an attacker as your ssh username/password. If you send the key on a non-encrypted channel that can also be intercepted and abused.

If you are concerned about security you can:


Add a full or self-signed ssl certificate to your webserver
Use a vpn or ssh tunnel to encrypt your non-encrypted (http) browser traffic
Just keep using ssh+drush to get the updates done