"It depends." (NB: "nopass" for doas is the equivalent of sudo's "NOPASSWD".) Like most things relating to security, whether its use is "a bad idea" or not de

"It depends." (NB: "nopass" for doas is the equivalent of sudo's "NOPASSWD".) Like most things relating to security, whether its use is "a bad idea" or not depends on many, many things: the attack surface, whom you are trying to defend against, other mitigations in place that protect the host, etc. As a general rule, I'd say that yes, it is a bad idea. However, I have an OpenBSD 5.9 laptop sitting here next to me on my desk at home: $ cat /etc/doas.conf permit nopass jeremy It also has a very restrictive firewall, allows SSH connections from a very limited set of remote hosts, has only one user account that can log in via SSH, allows authentication only via keys, runs no other services that can be accessed remotely, and uses full-disk encryption. The one user account on the host has a very long, complex password that I often have to look up in 1Password when logging in or resuming. Is it "a bad idea" to use "nopass" in this case? Strictly speaking, sure, but I'm really not too worried about it. There are a limited number of people who have physical access to it: myself, my girlfriend, friends & visitors we have over, and the few others who have a key to my house -- along with, I suppose, anyone who might break in, law enforcement armed with a warrant, and so on. I have, mentally, calculated the risk of the laptop being compromised via the use of "nopass" and deemed this risk acceptable. On the other hand, I have OpenBSD servers in data centers and even though the physical security is very good in those facilities, I do not allow "nopass" on those machines -- primarily because they do not have some of the "mitigations" that this laptop on my desk does.