I want to make Linux my main OS. I’ve used Windows for decades. Since Vista or 7, the Windows security model is this, from what I understand:
- unprivileged programs have limited/no ability to do scary things to your computer. they might be able to read some data, but it’s not going to implant malware in the boot sequence for Windows.
- if a program wants escalation, it triggers a UAC popup and the user has to accept it. Remote programs cannot accept UAC on a physical person’s behalf. Escalated programs have admin level control and can do the scary things.
- As with any OS, there may be privilege escalation vulnerabilities that escalate (1) into (2).
I’ve only had Windows malware a few times since Win7, and the entry point was fairly avoidable. (Running a sketchy EXE, and a possible drive-by malware install via an advertisement. I could never prove the latter.)
I have never run a password on my Windows machines.
On any system, physical access is game over.
On Linux, the password is paramount. I’ve tried to understand the security model and I keep failing. Synthesizing from arch wiki
SSH
Equivalent to local physical access as the user. If it’s a sudoers or root account, it can do scary things. Not a threat if ssh is disabled or well secured (password or key pairs).
If a network has a well configured firewall (on the router), it should block ssh requests from outside the network unless the admin specifically wants SSH outside the network.
As with any OS, there may be bugs that allow remote access outside of SSH.
Local login / password prompts to physical users
Without a password, you can’t escalate to root and install new software. Some software, often dealing with hardware (smartctl) requires sudo/root to run.
Encrypted drives
Passwords can decrypt drives if they are encrypted.
Keyrings
Some DEs (KDE) offer a ‘keyring’ that stores passwords. It’s locked/encrypted with a password, usually the same as the login password.
So what am I missing? Is Windows + UAC + no password secure? What is Linux protecting us from by using passwords?
Physical access isn’t game over, it’s only game over to a determined hacker. The vast majority of people aren’t competent enough for it to be an issue. It’s just like how a determined thief can get through almost any lock or door, but it takes effort and time, and skill which many casuals just won’t have.
Full-disk encryption passwords are the most important password, they can prevent physical access from being game-over.
Unix was originally designed to be multi-user, so different passwords protect different users from each other.
Linux doesn’t have a UAC-without-passwords equivalent really, programs can interact with the Linux UAC equivalents just as much as you can, so the password makes sure it’s really you, and not a malicious program or person. UAC on Linux would require an almost fundamental architecture change, in a way contrary to most of how Linux is used now.
Did you really never use a password with Windows? That seems wild to me.
I would say the challenge is not in the architecture, but in the general fragmentation of the ecosystem. PolicyKit is basically an equivalent to UAC, but it’s not used universally by everything that needs elevated access.
Technically polkit now, after the breaking change. It’s really not equivalent to UAC, because UAC does this “secure desktop” thing. Y’know how it becomes just the UAC prompt and a background sometimes? With no taskbar or other programs? It does that to restrict access to UAC.
With polkit prompts, there’s nothing stopping a mouse automation tool from accepting the polkit elevation request, so passwordless would be a guaranteed escalation attack, I tested software clicking the polkit buttons. A tool can’t do that now only because it doesn’t now your password. Implementing a “secure desktop” in polkit would be a big change in the architecture of security for Linux.
Yeah, you’re not wrong. What I meant was that polkit is conceptually equivalent to UAC (at least it is supposed to solve the same problem). However it’s not really a fair comparison, as “polkit on Linux” isn’t one concrete thing you can analyse, it’s more of a pile of Lego blocks, which you could assemble any which way. In theory, with Wayland you could build a secure polkit agent that would not allow the malware to interact with it.
In reality this is a moot point, as most privilege elevation is still done via sudo anyway.
I use run0 and pkexec in the Terminal! Only sometimes though.
The idea of not having a password at all is just so foreign to me, did you at least use biometrics or something?
It seems like not having a password would make some UAC bypasses easier, too.
I never used a password on Windows because I’ve never seen a reason for one. No one touches my computer. That’s what the physical locks on my doors are for.
I only use a password in Linux because it forces me to. The first thing I tried to do was disable it.
Thats fine until it isn’t.
Remember all the small folk people the government or other powerfull institutions fucked over in unjust ways for a wide range of reasons (sometimes down to personal grudges other times completely random)?
Yeah, it would be super easy to put some incriminating files on your computers and lock you up for years. Your grandma would be really sad.
Also on linux you can set everything to passwordless in polkit/sudoers or a blank password - it doesn’t actually force you and I’ve done that where it made sense (not on a PERSONAL computer)
If the government wants to fabricate a reason to prosecute me they’ll just bring some drugs to my house, the idea that they would go in with the plan to plant incriminating files on my computer (instead of just lying that there were incriminating files / showing a completely fake computer???) and then be foiled by a fucking password box and go “damn, he’s too clever for us, I guess we have to let him go” is just BEYOND ridiculous
deleted by creator
Nobody lives with you? Or visits you? You don’t use a laptop ever? What if someone does get through your locks?
You can set empty password up pretty easily, so you’ll just press enter to get through password prompts, just like how you’d click through password-less UAC prompts. Richard Stallman used to recommend that way back in the 80’s, on the big shared University machines.
I highly recommend a full-disk-encryption password even if you don’t have a traditional computer password, it’ll keep your data extra safe. Imagine the feds raid your house because Hexbear got designated a Foreign Terrorist Organization, the feds couldn’t get any Hexbear data off of the disk if it’s locked.
But it really feels like even if a password doesn’t add much security-wise, there’s basically no downside to it. My password is pretty long by conventional standards, but it takes a small fraction of a second to type it all out and login.
My grandmother, who has no interest in my computer.
No
No
What if someone guesses your password? Why don’t you keep your computer in a custom built safe bolted to the floor? There’s always another level of security you could hypothetically require, I just live in reality where the truth is no one is touching my computer.
It takes a second or so every time (sometimes a couple of seconds, I’m not always booting my computer with the intent to type shit immediately) which adds up over time. Sometimes I mistype, wasting 10+ seconds. And the benefit of this mild inconvenience is nothing.
It’s randomly generated, brute forcing it should take years.
I mean, I do keep it locked to stuff with a Kensington lock.
Fair, sometimes caps lock will do that to me.
I’m not saying you have to use a password, I’m just curious. I don’t think I know anyone IRL that doesn’t use a password with their computer.
Cool, so they use any number of exploits to simply go around the password. The point isn’t that a password is easy to get through (just like a locked door isn’t easy to get through) it is that if you’re facing a determined attacker it doesn’t matter how secure it is. If they have physical unsupervised access to your PC, you’ve already lost.
Fortunately for us all, these determined attackers do not exist. Nobody’s breaking my windows to boot up my fucking PC. The situation in which a password would help you is if someone has gone to the effort to bypass the physical security on your home, and then has no plan to deal with a password locked computer. They just take one look at it and go “welp, that’s it, everybody crawl back through the window then, watch the glass shards” Instead of picking up the entire PC and walking off with it, or yanking out the hard drives, or booting into their own preferred OS on a USB, or whatever else would actually happen if these made up attackers were real.