OpenSSH has user enumeration bug

Blowfish is faster than SHA256, and that's a problem when servers talk back

A bug in OpenSSH allows an attacker to check whether user names are valid on a 'net-facing server - because the Blowfish algorithm runs faster than SHA256/SHA512."