5 ms·

Using key-based auth without encrypting the key with a password sounds like a bad idea, as then any program running on the host can trivially gain root privileg

Using key-based auth without encrypting the key with a password sounds like a bad idea, as then any program running on the host can trivially gain root privileges.

remram 4y ago
Any program running as your user on your personal machine can trivially gain root privileges, by dropping a program called "sudo" in your personal PATH, putting a "sudo" command in your .bashrc, man-in-the-middle a shell (how do you know that last command actually completed?), or hijacking any of the graphical programs that trivially ask you for your UNIX password to do anything (Discord/Slack/... updater, Steam, ...)
- pxc 4y ago
  When do any of those programs ask you for your password? I've never had any of them ask for my Unix password, ever. Is that just a macOS thing with self-updaters?
  - remram 4y ago
    I'm using Ubuntu/KDE/Plasma. "Discover" is the GUI app that prompts you to install system updates, and will ask for your password when you do (to run apt/dpkg as root). Discord doesn't directly ask for my password, it downloads a .deb from somewhere and opens it, and I get prompted for my password then. Not much different IMHO.
    - still_grokking 4y ago
      I'm using Debian(Testing)/KDE/Plasma. (What was the point here?) I don't have any "Discover" installed as it's not needed for anything. There's aptitude… Regarding Discord: Discord is a virus. I try to avoid it. (And since you can't register without getting naked and showing the virus your telephone number it's not difficult to avoid ;-)).
      - nxpnsv 4y ago
        I don't think I ever gave discord a phone number...
        still_grokking 4y ago
        That just means you're fully transparent to them. (Likely they have linked other accounts / IIP data behind the scenes; using it form a phone will have that effect obviously). It's almost impossible to register an anonymous account there. Even if you find a throw-away SMS number that works to register (which is hard enough) a few hours later they will block that account again and require a fresh number to unlock. I've given up even trying to register there; but plan to fill out some GDPR complains soon. Thanks for reminding me to do so…
        zamadatix 4y ago
        More likely it just means they have an old account from when they weren’t as hung ho about it all and now they don’t delete it on a whim because it’s longstanding without issue. Same thing with mine, beyond it’s desperate for that phone number for things lately.
    - franga2000 4y ago
      Those are poklit popups, similar to UAC on Windows. The program doesn't get your password, but depending on what kind of access it requested, it could give it root access. If implemented correctly, the popup should say "wants to install a package" or "wants to mount drive X", which runs a predefined action on behalf of the app and doesn't actually give it any elevated permissions. Of course, like UAC, an app could just make its own prompt that looks like the real deal and steal the password, but that seems to be an unsolved problem on every platform.
- e44858 4y ago
  I’m guessing something like `chown root ~/.bash*` would prevent that, if all the folders in your PATH are owned by root.
  - remram 4y ago
    You can close some gaps, but at the end of the day you can't expect that you'll run malicious code but it won't do this or that. For example the X server allows any client to listen for key events or hook into other windows.
    - still_grokking 4y ago
      > For example the X server allows any client to listen for key events or hook into other windows. That's one of the reasons why "lock screens" are a lie under X. But that's one of the problems Wayland solves. It has a much better security story.
CameronNemo 4y ago
Nobody said you can't encrypt the key? Also some people use password-less sudo, so...

Using key-based auth without encrypting the key with a password sounds like a bad idea, as then any program running on the host can trivially gain root privileges.

remram 4y ago

Any program running as your user on your personal machine can trivially gain root privileges, by dropping a program called "sudo" in your personal PATH, putting a "sudo" command in your .bashrc, man-in-the-middle a shell (how do you know that last command actually completed?), or hijacking any of the graphical programs that trivially ask you for your UNIX password to do anything (Discord/Slack/... updater, Steam, ...)

pxc 4y ago
When do any of those programs ask you for your password? I've never had any of them ask for my Unix password, ever. Is that just a macOS thing with self-updaters?
- remram 4y ago
  I'm using Ubuntu/KDE/Plasma. "Discover" is the GUI app that prompts you to install system updates, and will ask for your password when you do (to run apt/dpkg as root). Discord doesn't directly ask for my password, it downloads a .deb from somewhere and opens it, and I get prompted for my password then. Not much different IMHO.
  - still_grokking 4y ago
    I'm using Debian(Testing)/KDE/Plasma. (What was the point here?) I don't have any "Discover" installed as it's not needed for anything. There's aptitude… Regarding Discord: Discord is a virus. I try to avoid it. (And since you can't register without getting naked and showing the virus your telephone number it's not difficult to avoid ;-)).
    - nxpnsv 4y ago
      I don't think I ever gave discord a phone number...
      - still_grokking 4y ago
        That just means you're fully transparent to them. (Likely they have linked other accounts / IIP data behind the scenes; using it form a phone will have that effect obviously). It's almost impossible to register an anonymous account there. Even if you find a throw-away SMS number that works to register (which is hard enough) a few hours later they will block that account again and require a fresh number to unlock. I've given up even trying to register there; but plan to fill out some GDPR complains soon. Thanks for reminding me to do so…
        zamadatix 4y ago
        More likely it just means they have an old account from when they weren’t as hung ho about it all and now they don’t delete it on a whim because it’s longstanding without issue. Same thing with mine, beyond it’s desperate for that phone number for things lately.
  - franga2000 4y ago
    Those are poklit popups, similar to UAC on Windows. The program doesn't get your password, but depending on what kind of access it requested, it could give it root access. If implemented correctly, the popup should say "wants to install a package" or "wants to mount drive X", which runs a predefined action on behalf of the app and doesn't actually give it any elevated permissions. Of course, like UAC, an app could just make its own prompt that looks like the real deal and steal the password, but that seems to be an unsolved problem on every platform.
e44858 4y ago
I’m guessing something like `chown root ~/.bash*` would prevent that, if all the folders in your PATH are owned by root.
- remram 4y ago
  You can close some gaps, but at the end of the day you can't expect that you'll run malicious code but it won't do this or that. For example the X server allows any client to listen for key events or hook into other windows.
  - still_grokking 4y ago
    > For example the X server allows any client to listen for key events or hook into other windows. That's one of the reasons why "lock screens" are a lie under X. But that's one of the problems Wayland solves. It has a much better security story.

CameronNemo 4y ago

Nobody said you can't encrypt the key? Also some people use password-less sudo, so...