7 ms·

Not the soundest security advice I've read recently: > We recommend that you use the same passphrase for your root password as you use for your LUKS encryption

by ivank 11y ago

Not the soundest security advice I've read recently: > We recommend that you use the same passphrase for your root password as you use for your LUKS encryption (unless you share your laptop with other trusted people who should be able to unlock the drives, but shouldn't be able to become root). If you are the sole user of the laptop, then having your root password be different from your LUKS password has no meaningful security advantages. Your root password is much easier to steal than your disk encryption password. Trick the user into running a program that does 'alias sudo=evil-sudo' >> ~/.bashrc, or sniff it from an unrelated X11 window, or use a microphone. A microphone is far more likely to pick up your root password than a password typed once at boot. If the root password is sniffed with a microphone, the attacker might not even have root access to your system over the network. If stolen with evil-sudo or via X11, you might realize you've been compromised before all of your data is exfiltrated. Neither scenario should let the attacker then steal your disks and be able to decrypt all of your data. Unless you follow the advice.

satai 11y ago
Maybe prepare a pullrequest for this? ;)
hnnh 11y ago
>Trick the user into running a program that does 'alias sudo=evil-sudo' >> ~/.bashrc That's only going to get you the user's password, not the root password.
- ivank 11y ago
  Good point. I've toned down my comment because that root password would be getting typed in less often. An attacker might still bring an evil-su in addition to an evil-sudo, though. And even if you're logging into that root user only in an another tty, it seems like an unnecessary risk to share the password with LUKS.
  - mricon 11y ago
    You actually tend to never use the root password on a modern workstation -- just sudo. The situations where you have to use a root password are usually if something has gone wrong and you have to log in via tty.
SturgeonsLaw 11y ago
Not to mention this gem: > it is fine to write down your passphrases and keep them in a safe place
- gozo 11y ago
  I don't see any problem with that. Physical security is much easier to manage than digital security.
- OJFord 11y ago
  The age-old "don't write your password down!" mantra is not meaningful without clarification. That is essentially, of course, how password managers work! There's no reason not to write a password down as long as it's securely stored. You probably need embarrassingly little physical security to store your password more safely than many dodgy website solutions! I _still_ frequently get my _already set_ password emailed to me in plaintext either on sign-up, or when I click "forgotten". (The site is always treated to an angry email encouraging a thorough redesign - though not of course, a 'reply', which would give them even easier access to my password!)
- jlgaddis 11y ago
  You left out the beginning and ending of that sentence: > "Unless you have concerns about physical security, it is fine to write down your passphrases and keep them in a safe place away from your work desk."
- anoother 11y ago
  Good enough for Bruce Schneier: https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo...
- SmellyGeekBoy 11y ago
  Why not? Write them all on a piece of paper and lock it in a safe. Probably much safer than a password manager.
  - Tenhundfeld 11y ago
amalcon 11y ago
Frankly, I find it suspect that they even suggest having a root password. The only situation where this is useful is when sudo is somehow broken (e.g. a typo in /etc/sudoers). This happens rarely enough that I'm OK with a more heavyweight process (like booting Knoppix) to fix it.
- mjevans 11y ago
  It's the annoying times when your system forces you in to single user mode for repairs, and you have to enter something... or else boot up a rescue disk (the proper solution) to fix it, that make having a root password at all a sometimes good idea. Really though, that rescue disk sounds like a better idea every time I think about the situation.
  - yellowapple 11y ago
    Depending on the breakage (e.g. if your initrd got borked), you'll probably need the rescue disk anyway in order to have access to the necessary tools to activate RAID arrays, decrypt disks, activate LVM VGs, etc. Even without, IIRC, Ubuntu (one of the few systems that actually gets root passwords right by defaulting to it being randomly-generated garbage that nobody knows) will prompt for the credentials of a sudo-capable user even for single-user mode.
fluidcruft 11y ago
I'm struggling to understand any situation where you should ever be typing either your LUKS password or your root password into a fully operating/running system. If you're using sudo correctly, you do not enter your root password. Frankly, the only time I can remember being prompted for a root password in years is when the system has failed to boot and offers entry to a recovery/maintenance shell. If you're using LUKS correctly for your boot drive, you enter it only during startup before the system has booted. If someone has access to your disk and has your LUKS key, the root password is merely a formality.
- ivank 11y ago
  You are entirely correct and it is too bad I did not delete my comment in time. Here I am with an intense dislike of bogus criticism on HN and yet perpetuating some. Sleep before you post...
- baghira 11y ago
  What I found problematic (unless I'm missing something) was the suggestion that your day-to-day user should be in the wheel group: if that's the case, once your user is compromised the attacker can edit .bashrc to change $PATH and use a patched sudo to take over the machine. IMHO "sudo" (or "doas") should be used from a different user, by switching to a different VT. Or at least only allowing certain commands for you day to day user.
  - ivank 11y ago
    sudo'ing as your day-to-day user is dangerous for another reason, too: the default 15 minute password timeout lets subprocesses in your shell use your sudo credentials, even if you didn't intend them to. e.g. sudo command, then later ./some-installer.sh - you didn't want to give some-installer.sh root, but it opportunistically uses 'sudo' and succeeds. (I disable credential caching with "Defaults timestamp_timeout=0" in /etc/sudoers.)
    - baghira 11y ago
      Sure, it always bothered me that guides show whole lists of commands prefixed by sudo, instead of teaching people to disable the timeout and use "sudo -i" or "sudo -s" to get their stuff done. See also the fact that OSX ships with tty_tickets disabled. Still, unless one is sure that the sudo being invoked really is sudo, disabling the timeout won't be enough.
woebtz 11y ago
What do you mean by microphone? Is audio analysis of keyboard chatter a thing or are we leaking passwords when we verbally communicate them to a co-worker? I don't think this is related, but I found this keylogging technique combining microphone, camera, accelerometer data to approximate finger/thumb positions for PIN numbers: http://www.cl.cam.ac.uk/~rja14/Papers/pinskimmer_spsm13.pdf http://www.cl.cam.ac.uk/~rja14/Papers/pinskimmer_spsm13.pdf
- dllthomas 11y ago
  Audio analysis of keyboard chatter is a thing that had a proof of concept years ago. I have no idea how often it is done, but it is certainly plenty possible.

by ivank 11y ago

satai 11y ago

Maybe prepare a pullrequest for this? ;)

hnnh 11y ago

>Trick the user into running a program that does 'alias sudo=evil-sudo' >> ~/.bashrc That's only going to get you the user's password, not the root password.

ivank 11y ago
Good point. I've toned down my comment because that root password would be getting typed in less often. An attacker might still bring an evil-su in addition to an evil-sudo, though. And even if you're logging into that root user only in an another tty, it seems like an unnecessary risk to share the password with LUKS.
- mricon 11y ago
  You actually tend to never use the root password on a modern workstation -- just sudo. The situations where you have to use a root password are usually if something has gone wrong and you have to log in via tty.

SturgeonsLaw 11y ago

Not to mention this gem: > it is fine to write down your passphrases and keep them in a safe place

gozo 11y ago
I don't see any problem with that. Physical security is much easier to manage than digital security.
OJFord 11y ago
The age-old "don't write your password down!" mantra is not meaningful without clarification. That is essentially, of course, how password managers work! There's no reason not to write a password down as long as it's securely stored. You probably need embarrassingly little physical security to store your password more safely than many dodgy website solutions! I _still_ frequently get my _already set_ password emailed to me in plaintext either on sign-up, or when I click "forgotten". (The site is always treated to an angry email encouraging a thorough redesign - though not of course, a 'reply', which would give them even easier access to my password!)
jlgaddis 11y ago
You left out the beginning and ending of that sentence: > "Unless you have concerns about physical security, it is fine to write down your passphrases and keep them in a safe place away from your work desk."
anoother 11y ago
Good enough for Bruce Schneier: https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo...
SmellyGeekBoy 11y ago
Why not? Write them all on a piece of paper and lock it in a safe. Probably much safer than a password manager.
- Tenhundfeld 11y ago

amalcon 11y ago

Frankly, I find it suspect that they even suggest having a root password. The only situation where this is useful is when sudo is somehow broken (e.g. a typo in /etc/sudoers). This happens rarely enough that I'm OK with a more heavyweight process (like booting Knoppix) to fix it.

mjevans 11y ago
It's the annoying times when your system forces you in to single user mode for repairs, and you have to enter something... or else boot up a rescue disk (the proper solution) to fix it, that make having a root password at all a sometimes good idea. Really though, that rescue disk sounds like a better idea every time I think about the situation.
- yellowapple 11y ago
  Depending on the breakage (e.g. if your initrd got borked), you'll probably need the rescue disk anyway in order to have access to the necessary tools to activate RAID arrays, decrypt disks, activate LVM VGs, etc. Even without, IIRC, Ubuntu (one of the few systems that actually gets root passwords right by defaulting to it being randomly-generated garbage that nobody knows) will prompt for the credentials of a sudo-capable user even for single-user mode.

fluidcruft 11y ago

I'm struggling to understand any situation where you should ever be typing either your LUKS password or your root password into a fully operating/running system. If you're using sudo correctly, you do not enter your root password. Frankly, the only time I can remember being prompted for a root password in years is when the system has failed to boot and offers entry to a recovery/maintenance shell. If you're using LUKS correctly for your boot drive, you enter it only during startup before the system has booted. If someone has access to your disk and has your LUKS key, the root password is merely a formality.

ivank 11y ago
You are entirely correct and it is too bad I did not delete my comment in time. Here I am with an intense dislike of bogus criticism on HN and yet perpetuating some. Sleep before you post...
baghira 11y ago
What I found problematic (unless I'm missing something) was the suggestion that your day-to-day user should be in the wheel group: if that's the case, once your user is compromised the attacker can edit .bashrc to change $PATH and use a patched sudo to take over the machine. IMHO "sudo" (or "doas") should be used from a different user, by switching to a different VT. Or at least only allowing certain commands for you day to day user.
- ivank 11y ago
  sudo'ing as your day-to-day user is dangerous for another reason, too: the default 15 minute password timeout lets subprocesses in your shell use your sudo credentials, even if you didn't intend them to. e.g. sudo command, then later ./some-installer.sh - you didn't want to give some-installer.sh root, but it opportunistically uses 'sudo' and succeeds. (I disable credential caching with "Defaults timestamp_timeout=0" in /etc/sudoers.)
  - baghira 11y ago
    Sure, it always bothered me that guides show whole lists of commands prefixed by sudo, instead of teaching people to disable the timeout and use "sudo -i" or "sudo -s" to get their stuff done. See also the fact that OSX ships with tty_tickets disabled. Still, unless one is sure that the sudo being invoked really is sudo, disabling the timeout won't be enough.

woebtz 11y ago

What do you mean by microphone? Is audio analysis of keyboard chatter a thing or are we leaking passwords when we verbally communicate them to a co-worker? I don't think this is related, but I found this keylogging technique combining microphone, camera, accelerometer data to approximate finger/thumb positions for PIN numbers: http://www.cl.cam.ac.uk/~rja14/Papers/pinskimmer_spsm13.pdf http://www.cl.cam.ac.uk/~rja14/Papers/pinskimmer_spsm13.pdf

dllthomas 11y ago
Audio analysis of keyboard chatter is a thing that had a proof of concept years ago. I have no idea how often it is done, but it is certainly plenty possible.