4 ms·

So, then, this still strikes me as bad in a different way, it contributes to the Windows-esque habit of presuming to know whats best for the user -- even when t

by jrm4 6y ago

So, then, this still strikes me as bad in a different way, it contributes to the Windows-esque habit of presuming to know whats best for the user -- even when the user is an "administrator." It seems as if the Linux approach is more honest. "You're root? Okay, you can have access to your SSH-keys. Be careful."

teh_klev 6y ago
Well that behaviour can still be configured on Windows with not much effort provided your sysadmins RTFM. It's about how well you secure your machines, regulate behaviour and ensure good platform hygiene, the OS you're running is irrelevant. I speak as a platform agnostic shared hoster guy who managed fleets of Windows and Linux environments, all public facing, and inherited an unholy security mess many years ago, both Windows and Linux, and had to unfuck it all. I could go into detail for the curious.
- azalemeth 6y ago
  I'm curious. Can you tell us more? While the plural of anecdotes isn't data, I'd like to know some examples of "the good, the bad and the ugly" on both OS fronts.
formerly_proven 6y ago
> It seems as if the Linux approach is more honest. "You're root? Okay, you can have access to your SSH-keys. Be careful." Actually even root will get plenty of permission denied errors on a Linux system configured for security.
Dylan16807 6y ago
There are three things in the way of getting the keys, and they all seem honest to me. 1. You need admin access to reach the data. 2. The user has to have entered their password to allow DPAPI to unencrypt the data. 3. The data is stored in a binary form because that was the most convenient. The DPAPI stuff wasn't just obfuscation, if that's what you're thinking. The steps you need are going to look roughly the same if you want to access someone's encrypted files on linux. It doesn't transparently decrypt the data, but that's because the encryption isn't built into the registry, not because it's trying to keep it away from you.

by jrm4 6y ago

teh_klev 6y ago

Well that behaviour can still be configured on Windows with not much effort provided your sysadmins RTFM. It's about how well you secure your machines, regulate behaviour and ensure good platform hygiene, the OS you're running is irrelevant. I speak as a platform agnostic shared hoster guy who managed fleets of Windows and Linux environments, all public facing, and inherited an unholy security mess many years ago, both Windows and Linux, and had to unfuck it all. I could go into detail for the curious.

azalemeth 6y ago
I'm curious. Can you tell us more? While the plural of anecdotes isn't data, I'd like to know some examples of "the good, the bad and the ugly" on both OS fronts.

formerly_proven 6y ago

> It seems as if the Linux approach is more honest. "You're root? Okay, you can have access to your SSH-keys. Be careful." Actually even root will get plenty of permission denied errors on a Linux system configured for security.

Dylan16807 6y ago

There are three things in the way of getting the keys, and they all seem honest to me. 1. You need admin access to reach the data. 2. The user has to have entered their password to allow DPAPI to unencrypt the data. 3. The data is stored in a binary form because that was the most convenient. The DPAPI stuff wasn't just obfuscation, if that's what you're thinking. The steps you need are going to look roughly the same if you want to access someone's encrypted files on linux. It doesn't transparently decrypt the data, but that's because the encryption isn't built into the registry, not because it's trying to keep it away from you.