10 ms·
It's frustrating that you never hear the pro-unlocking scene actually looking past their own noses. Like back when you could bypass a linux login screen by pres
by zelon88 8y ago
It's frustrating that you never hear the pro-unlocking scene actually looking past their own noses. Like back when you could bypass a linux login screen by pressing backspace 28 times. Obviously that's a problem, but could you imagine if police departments all over the country got pissed when that bug was fixed and started complaining that they couldn't use the exploit themselves? Like they're the only ones smart enough to use the exploit and nobody else would ever do such a thing for malicious reasons. It's so short sighted.
- theclaw 8y agoI just looked this up and to save others the time, this was an integer underflow bug in the Grub2 bootloader's password protection[0], not Linux itself. Cool example, though. [0] http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html#exploit http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-by...
- VirtualAirwaves 8y agoC'mon. If it's part of a Linux distribution it's part of "Linux".
- azinman2 8y agoTell that to Richard Stallman, who will go ape if you call GNU tools “Linux”
- Crontab 8y agoI like Stallman but he can be a pedantic prick.
- ovao 8y agoThe “prick” isn’t necessary: you could just as easily have said that he can be pedantic and left it at that.
- branchless 8y agoHe's an absolute visionary. Can you imagine how much you'd be paying to access a computer without him?
- LeoPanthera 8y agoThat's misleading even if you're not a follower of Stallman. Lots of operating systems use Grub that aren't Linux-based.
- newnewpdro 8y agoThere's a substantial difference between grub password protection, a feature which I've never seen anyone use in practice and the ubiquitous login prompt. The OP specifically said the login prompt was defeated by backspacing alone.
- stevekemp 8y agoReminds me of the bug in Solaris where you could get root by essentially pressing entering a username and mashing the keyboard a bit: https://groups.google.com/forum/#!msg/muc.lists.bugtraq/5zYUw5Kt_UU/CaTUzTt6b10J https://groups.google.com/forum/#!msg/muc.lists.bugtraq/5zYU...
- opan 8y agoNot really. You can use Syslinux in place of GRUB (in fact, I was when this bug was first appearing in the news). I also think it's bad practice to generalize things to that point. There is of course the obvious issue of Linux just referring to the kernel, making it hard to talk about just the kernel if you get into the bad habit of referring to many things by that same name. More importantly, though, if there's a bug in GNOME or your file manager, it feels very wrong for someone to say it's a problem with "Linux". I think this distinction matters more due to the modularity of GNU/Linux and all the choices of programs for basic tasks.
- Veedrac 8y agoAn issue which wouldn't exist if Apple provided access for people with warrants.
- JumpCrisscross 8y ago> if Apple provided access for people with warrants Doesn't this face the TSA Master Key problem?
- Veedrac 8y agoNo, because Apple isn't incompetent, and is long-used to securely handling customer data.
- redial 8y agoThe "TSA Problem" is not that they master-key manufacturer is incompetent...quite the contrary.
- dane-pgp 8y agoAhem: https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_photos https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_phot...
- Veedrac 8y ago> access was later revealed to have been gained via targeted phishing attacks
- dane-pgp 8y agohttps://www.ibtimes.co.uk/icloud-accounts-risk-brute-force-attack-hacker-exploits-painfully-obvious-password-flaw-1481623 https://www.ibtimes.co.uk/icloud-accounts-risk-brute-force-a... "Last September, Apple said it had made changes to iCloud security and introduced a measure to stop software from making multiple automated guesses. While this is the case when trying to log in on a computer, unlimited guesses can be made using an iOS device, which is what this software pretends to be when accessing iCloud from a computer running it."
- mirimir 8y agoLast time I checked, you can still force single-user mode at bootup, and reset the root password.
- jake_the_third 8y agoOnly if you don't use full-disk encryption, since the entire filesystem, including passwd/shadow, is editable. In fact, the same principle can be used to reset and extract windows user passwords. Something I did many times as an IT support technician.
- mirimir 8y agoSure. But how prevalent is FDE?
- newnewpdro 8y agoFDE is the norm for desktop/laptop users, we're well beyond that in the GNU/Linux world. The exception these days is leveraging secure boot and the tpm to ensure the kernel and initrd being booted and asking for your dmcrypt password can be trusted. That's our next challenge to make the standard.
- SteveNuts 8y agoMaybe it's just my experience but I haven't seen FDE be the norm within any of the companies I've worked for, and I've been in startup all the way to fortune 15...
- lathiat 8y agoI had an encryption requirement at both Oracle (for Windows) and Canonical (for Linux). For Windows they used some endpoint protection suite; for Canonical the functionality is built-in to the Ubuntu installer. Also since I own a Mac as my primary laptop, I've just always used filevault there and it helps me sleep a lot at night. Means I am not concerned if it gets stolen, my derpy photos won't be in someone elses hand. I don't care so much about the hardware.
- AngryData 8y agoIn old windows versions you could access user controls through the help menu and make yourself a new user to login.