> fake the `sudo` command. I personally see that "su" and "sudo" are both fundamentally insecure. Compromising any sudoer, and root is essentially lost (e.g. k

> fake the `sudo` command. I personally see that "su" and "sudo" are both fundamentally insecure. Compromising any sudoer, and root is essentially lost (e.g. keyloggers), thus the "wheel" group should only contain trusted accounts. It can be more secure if all root operations require a separate console, isolated from the rest of the world. For example, on historical Unix servers, it was a common practice to restrict root logins to a physical terminal. But nowadays it's unfeasible. One solution for servers is disabling "su" and "sudo", and to allow root logins via pubkeys. This goes against the best practices, but can be more secure when it's used properly. Alternatively, create an "admin" account with sudo privilege, and guard it as carefully as your root account, because a sudoer is root. On desktop, a solution can be using Intel ME/SGX/TXT and allowing it to take over your screen and keyboard to create a root shell - but it is proprietary, unauditable, and cannot be trusted. But it's not strictly needed - pure software can do something similar, e.g. you run two X servers on two separate VTs with two users, only the second user has access to a root shell. I guess better integration at the graphics server/system level is possible, you just need to be careful about GUI spoofing. For example, on Windows NT, pressing Control+Alt+Delete opens an unspoofable & isolated secure login screen - perhaps we should implement a secure root shell like that! A more practical, although much less secure alternative is requiring 2FA, e.g. pressing a physical button on a USB token to sudo, it's something you can use today. But it cannot solve the problem of malicious command injections. But on second thought, these problems are not really a priority in infosec - user applications are insecure in general, and user data is accessible without root anyway... As xkcd said, "they can read my mails, take my money, and impersonate me, but at least they cannot install device drivers without my permission..." So doing all of the works can be a total waste of time. Also, even with a separate root console, one must also have strong discipline not to execute anything or opening any complex binary data from another user (potentially compromised), which makes the whole idea fragile. Finally QubesOS's approach is an innovative workaround and worth mentioning - normal and sensitive applications are running in separate VMs, providing strong isolation. Since both system and user applications are already isolated, it's not really that dangerous to be "root", so by default, everyone can sudo without any authentication. But if you are concerned about someone attacking supervisor via root, you can use Dom0 to 2FA authenticate sudo in an application VM without any extra hardware.