It provides independent verification to both host and user. The password is then decrypted on the local machine. Once verified, the user gets another set of credentials from each host. So, let's examine the four areas of potential compromise using Kerberos now. Eavesdropping - prevents eavesdropping since passwords don't go anywhere.
Decryption is on local machine.
This is a more thorough safety measure than ssh unless there is a method for host key distribution. Guessing - difficult since Kerberos is an encrypted key. Password Sharing - doesn't fix. Storing - doesn't fix, but greatly reduces the need. Mark cautioned that Kerberos works with strong security surrounding the KDC's.