3 ms·

All security is just putting roadblocks in place to buy you time to notice and to make you an unattractive target, same physically as digitally (you don't reall

All security is just putting roadblocks in place to buy you time to notice and to make you an unattractive target, same physically as digitally (you don't really think your front door lock will keep someone out that really want in, right?). Passworded sudo is just another roadblock to give you more time. Passwordless means instead of the attacker getting local root and then having to find an exploit, they immediately get to escalate to root. For very sophisticated attackers, it may by a trivial difference in time, but for unsophisticated ones it may mean they don't get root to do more damage. And given that sophisticated attackers are ones you can't really guard well against without a whole department devoted to it, unsophisticated ones are probably ones you should really make sure not to ignore.

jacquesm 5y ago
> you don't really think your front door lock will keep someone out that really want in, right? I recently had the - unfortunate - opportunity to put this to the test. The house I live in has the highest grade burglary protection that you can still buy for normal money (courtesy of the previous owner). It still only took me 35 minutes to break into it when I accidentally closed the door behind me when there was nobody else home. This kind of surprised me, because I didn't have access to any tools at all, just the stuff that was laying around in the garden (some sticks and a little bit of steel wire). And all that without breaking anything, if that constraint would not have been there the 35 minutes would have been reduced to 30 seconds, tops. Later I figured out three other ways to get in without any damage, but most of those would have cost a bit more time.
- kungito 5y ago
  What is your house made of? How can you have multiple ways of entering a house without any damage if you have walls, doors and windows? What else is there?
  - dghlsakjg 5y ago
    Doors and windows are designed to open, and frequently they don't lock automatically (or the lock is VERY insecure). There are crawl spaces, attics, mail slots, balconies, garage doors, etc. that frequently connect the outside to the inside.
    - jacquesm 5y ago
      Two out of three ;)
    - yread 5y ago
      Don't forget the chimney. Ho ho ho!
  - jacquesm 5y ago
    > How can you have multiple ways of entering a house without any damage if you have walls, doors and windows? Given that it is pretty trivial to find out where I live I'm not going to write that up here, you're going to have to take my word for it. But the hacker mentality applies to houses just as it applies to servers. You just need to think a bit more adversarial.
- dx034 5y ago
  I live in a rather modern European apartment/condo and I don't think this would be true for my home at all. Sure, with the right tools you can get windows or doors open, but it will be very loud and not that easy. Windows are triple glazed (for insulation, not protection) and they have a fair amount of locks on all sides (can be annoying as they won't close if any of those are blocked by dirt or leave). If you just close the door without locking it, it's possible to open them without causing too much damage. But I heard from neighbours who got locked out that if you have your door locked, even a locksmith will at least need to destroy the lock, potentially even part of the door, to get inside. There's no such thing as perfect protection, but most thieves will ignore objects that take longer than a minute or two to break in to. There are too many alternatives and any minute spent at the door increases the risk of detection. Also, apart from doors or windows there are no openings. There's ventilation but the diameter is way too small to crawl through. And access from parking is secured the same way as through the front door. So yes, I think a front door lock will keep out thieves. Not because it makes it impossible but because it's just not worth it. Same as a well protected server all but keeps out intruders. Unless you're a very high value target, they go after easier targets first.
  - jacquesm 5y ago
    Apartments are probably harder than houses, fewer points of entry pretty much ensure that. But I've lived in apartments as well and in fact a few years ago in Bucharest I had to do something quite similar and that worked just fine as well. It all depends on how much you know about how stuff is put together to be able to spot the weak points in a structure. But a properly designed and implemented security layer for an apartment would be hard or even impossible to crack without damage. The devil is in the details though and compared to a thief, if it is your own place you have a lot of motivation not to damage it and a lot of time.
    - kaliszad 5y ago
      I have one "shut myself" out of my apartment when I have replaced the tag and a draft closed the door - when I realized, I don't have any keys. I knew, one window was angle opened in the kitchen right next to the balcony. I asked my neighbours, if I could climb over. It was the third floor, so I kind of hesitated, but there were multiple robust things I could hold onto. I used my belt to move the handle of another window 90° so it would open like a door through just the 5 cm opening at the top of the other window. Nobody saw me, nobody asked anything. I could perhaps climb to the balcony easily even though I don't do any climbing otherwise. After this, I never left the apartment with any angle-opened window after that.
fsflover 5y ago
See also: https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing)
avar 5y ago
> Passworded sudo is just another roadblock to give you more time. The problem with this world-view is that it's a fallacy. You're assuming that people won't be bothered by having to re-type their password all the time, and just implement a "secure" script using a setuid bit instead. Now someone else intentionally adds the ability to allow that script to execute arbitrary commands and you've got a vulnerability with passworded sudo that would have never happened with passwordless sudo. I've seen that same story happen countless times in the real world. E.g. a company I worked for went from a "bastion" login system (authenticate once) for the sysadmin "run a command on the fleet" interface of last resort to requiring "re-authentication on login", which now needed a re-login with a OTP for each machine, in a datacenter with quite a few machines. That's conceptually the same as insisting on passworded sudo in terms of security. Guess what happened next in that setup? No points for "sysadmins just got used to re-typing their passwords in the for-loop" :)
- kbenson 5y ago
  > The problem with this world-view is that it's a fallacy. There's nothing fallacious about the concept that security controls are just roadblocks. There is no such thing as perfect security for a system that requires someone to be able to access or use it. All security controls do is provide time and/or notification of someone trying to break in, if all goes well. Then you can hope to mount a more active defense of some sort if needed. > You're assuming that people won't be bothered by having to re-type their password all the time, and just implement a "secure" script using a setuid bit instead. Obviously there's a trade off for how cumbersome it is to use something in an authorized manner and how much people will attempt to work around that inconvenience. What is a fallacy is that any inconvenience in the same of security is not worthwhile. In many configurations of sudo shipped by default in common distros, it caches your auth for that tty for a number of minutes, so after you auth you don't have to auth again for a while. You can easily change this, and make it so that after you auth in a tty, you won't have to auth again for 24 hours if you wanted. You would still have quite a bit of protection from attackers (at least those that weren't at an unlocked screen of yours with one of those terminals), and entering a password once a dayis probably acceptable to most people (in reality, once a day per terminal they want to use it in, but it's not hard to keep one terminal open for secure use). > Now someone else intentionally adds the ability to allow that script to execute arbitrary commands and you've got a vulnerability with passworded sudo that would have never happened with passwordless sudo. It's hard to protect against stupidity. Either train people to not to stupid things, or if your security policy is actually too onerous, then reassess what the correct policy should be and implement it. To be clear, I doubt the correct policy is "let's just turn off all the security because we're lazy". > That's conceptually the same as insisting on passworded sudo in terms of security. It's easy to say it is, because almost everything is conceptually the same thing if you boil them down to a few related concepts and attributes and then ignore the magnitude and impact of those things. I mean, shooting someone with a Nerf gun and shooting someone with a Glock are conceptually the same things, right? So, please, let's not act like having to enter your password once every few minutes when needed for root access (or longer, if you configure it to) is equivalent to jumping through multiple systems, authing additional times at each level, and requiring OOB auth additionally. If you're really annoyed by sudo, just "sudo bash" and keep the terminal open. At least you still get some protection from local user access privilege escalation.

jacquesm 5y ago

> you don't really think your front door lock will keep someone out that really want in, right? I recently had the - unfortunate - opportunity to put this to the test. The house I live in has the highest grade burglary protection that you can still buy for normal money (courtesy of the previous owner). It still only took me 35 minutes to break into it when I accidentally closed the door behind me when there was nobody else home. This kind of surprised me, because I didn't have access to any tools at all, just the stuff that was laying around in the garden (some sticks and a little bit of steel wire). And all that without breaking anything, if that constraint would not have been there the 35 minutes would have been reduced to 30 seconds, tops. Later I figured out three other ways to get in without any damage, but most of those would have cost a bit more time.

kungito 5y ago
What is your house made of? How can you have multiple ways of entering a house without any damage if you have walls, doors and windows? What else is there?
- dghlsakjg 5y ago
  Doors and windows are designed to open, and frequently they don't lock automatically (or the lock is VERY insecure). There are crawl spaces, attics, mail slots, balconies, garage doors, etc. that frequently connect the outside to the inside.
  - jacquesm 5y ago
    Two out of three ;)
  - yread 5y ago
    Don't forget the chimney. Ho ho ho!
- jacquesm 5y ago
  > How can you have multiple ways of entering a house without any damage if you have walls, doors and windows? Given that it is pretty trivial to find out where I live I'm not going to write that up here, you're going to have to take my word for it. But the hacker mentality applies to houses just as it applies to servers. You just need to think a bit more adversarial.
dx034 5y ago
I live in a rather modern European apartment/condo and I don't think this would be true for my home at all. Sure, with the right tools you can get windows or doors open, but it will be very loud and not that easy. Windows are triple glazed (for insulation, not protection) and they have a fair amount of locks on all sides (can be annoying as they won't close if any of those are blocked by dirt or leave). If you just close the door without locking it, it's possible to open them without causing too much damage. But I heard from neighbours who got locked out that if you have your door locked, even a locksmith will at least need to destroy the lock, potentially even part of the door, to get inside. There's no such thing as perfect protection, but most thieves will ignore objects that take longer than a minute or two to break in to. There are too many alternatives and any minute spent at the door increases the risk of detection. Also, apart from doors or windows there are no openings. There's ventilation but the diameter is way too small to crawl through. And access from parking is secured the same way as through the front door. So yes, I think a front door lock will keep out thieves. Not because it makes it impossible but because it's just not worth it. Same as a well protected server all but keeps out intruders. Unless you're a very high value target, they go after easier targets first.
- jacquesm 5y ago
  Apartments are probably harder than houses, fewer points of entry pretty much ensure that. But I've lived in apartments as well and in fact a few years ago in Bucharest I had to do something quite similar and that worked just fine as well. It all depends on how much you know about how stuff is put together to be able to spot the weak points in a structure. But a properly designed and implemented security layer for an apartment would be hard or even impossible to crack without damage. The devil is in the details though and compared to a thief, if it is your own place you have a lot of motivation not to damage it and a lot of time.
  - kaliszad 5y ago
    I have one "shut myself" out of my apartment when I have replaced the tag and a draft closed the door - when I realized, I don't have any keys. I knew, one window was angle opened in the kitchen right next to the balcony. I asked my neighbours, if I could climb over. It was the third floor, so I kind of hesitated, but there were multiple robust things I could hold onto. I used my belt to move the handle of another window 90° so it would open like a door through just the 5 cm opening at the top of the other window. Nobody saw me, nobody asked anything. I could perhaps climb to the balcony easily even though I don't do any climbing otherwise. After this, I never left the apartment with any angle-opened window after that.

fsflover 5y ago

See also: https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing)

avar 5y ago

> Passworded sudo is just another roadblock to give you more time. The problem with this world-view is that it's a fallacy. You're assuming that people won't be bothered by having to re-type their password all the time, and just implement a "secure" script using a setuid bit instead. Now someone else intentionally adds the ability to allow that script to execute arbitrary commands and you've got a vulnerability with passworded sudo that would have never happened with passwordless sudo. I've seen that same story happen countless times in the real world. E.g. a company I worked for went from a "bastion" login system (authenticate once) for the sysadmin "run a command on the fleet" interface of last resort to requiring "re-authentication on login", which now needed a re-login with a OTP for each machine, in a datacenter with quite a few machines. That's conceptually the same as insisting on passworded sudo in terms of security. Guess what happened next in that setup? No points for "sysadmins just got used to re-typing their passwords in the for-loop" :)

kbenson 5y ago
> The problem with this world-view is that it's a fallacy. There's nothing fallacious about the concept that security controls are just roadblocks. There is no such thing as perfect security for a system that requires someone to be able to access or use it. All security controls do is provide time and/or notification of someone trying to break in, if all goes well. Then you can hope to mount a more active defense of some sort if needed. > You're assuming that people won't be bothered by having to re-type their password all the time, and just implement a "secure" script using a setuid bit instead. Obviously there's a trade off for how cumbersome it is to use something in an authorized manner and how much people will attempt to work around that inconvenience. What is a fallacy is that any inconvenience in the same of security is not worthwhile. In many configurations of sudo shipped by default in common distros, it caches your auth for that tty for a number of minutes, so after you auth you don't have to auth again for a while. You can easily change this, and make it so that after you auth in a tty, you won't have to auth again for 24 hours if you wanted. You would still have quite a bit of protection from attackers (at least those that weren't at an unlocked screen of yours with one of those terminals), and entering a password once a dayis probably acceptable to most people (in reality, once a day per terminal they want to use it in, but it's not hard to keep one terminal open for secure use). > Now someone else intentionally adds the ability to allow that script to execute arbitrary commands and you've got a vulnerability with passworded sudo that would have never happened with passwordless sudo. It's hard to protect against stupidity. Either train people to not to stupid things, or if your security policy is actually too onerous, then reassess what the correct policy should be and implement it. To be clear, I doubt the correct policy is "let's just turn off all the security because we're lazy". > That's conceptually the same as insisting on passworded sudo in terms of security. It's easy to say it is, because almost everything is conceptually the same thing if you boil them down to a few related concepts and attributes and then ignore the magnitude and impact of those things. I mean, shooting someone with a Nerf gun and shooting someone with a Glock are conceptually the same things, right? So, please, let's not act like having to enter your password once every few minutes when needed for root access (or longer, if you configure it to) is equivalent to jumping through multiple systems, authing additional times at each level, and requiring OOB auth additionally. If you're really annoyed by sudo, just "sudo bash" and keep the terminal open. At least you still get some protection from local user access privilege escalation.