No Password Needed Nor Wanted (Solved)

All Gurus once were Newbies
Forum rules
There are no such things as "stupid" questions. However if you think your question is a bit stupid, then this is the right place for you to post it. Please stick to easy to-the-point questions that you feel people can answer fast. For long and complicated questions prefer the other forums within the support section.
Before you post please read how to get help
User avatar
Larry78723
Level 5
Level 5
Posts: 662
Joined: Wed Jan 09, 2019 7:01 pm
Location: Jasper County, SC, USA

Re: No Password Needed Nor Wanted

Post by Larry78723 » Fri Apr 05, 2019 7:05 pm

Marie, apparently you don't agree with the first of your own signature lines. :roll:
Image

User avatar
bob466
Level 4
Level 4
Posts: 484
Joined: Mon May 15, 2017 5:23 am
Location: Australia

Re: No Password Needed Nor Wanted

Post by bob466 » Fri Apr 05, 2019 7:20 pm

Some people just don't understand what security is... Image and that's the difference between Windoze and Linux but as always if you don't like it...go back to Windoze. Image
Linux For Ever...Windoze Never Image

Marie SWE
Level 2
Level 2
Posts: 73
Joined: Wed Feb 28, 2018 7:32 pm
Location: Sweden

Re: No Password Needed Nor Wanted

Post by Marie SWE » Fri Apr 05, 2019 7:22 pm

Larry78723 wrote:
Fri Apr 05, 2019 7:05 pm
Marie, apparently you don't agree with the first of your own signature lines. :roll:
Of course I do
But it is just as easy to use a keylogger to capture the password as creating a virus that can click OK on a screen
Nothing is impossible, the impossible just takes a little longer to complete...
It is like it is, because you do what you do, if you hadn't done as you did, it wouldn't have been as it is. ;)

User avatar
karlchen
Level 20
Level 20
Posts: 10829
Joined: Sat Dec 31, 2011 7:21 am
Location: Germany

Re: No Password Needed Nor Wanted

Post by karlchen » Fri Apr 05, 2019 7:40 pm

Marie SWE wrote:
Fri Apr 05, 2019 6:59 pm
Okay, if anyone is gaining control of my computer. Doesn't that requires a virus with root privileges?
No, it does not require a virus and it does not require root privileges to start with. Acquiring root privileges on your computer may be the goal. But it would be the last step in gaining control of your system. The first step might be connecting to your computer using your account name. In case your account is not protected by a strong password, this will not be impossible, provided someone succeeds in finding out your loginname.

About viruses:
A lot of users tend to call any malware viruses. This is incorrect, however. Like a biological virus, a computer virus is a kind of malware which can replicate itself. Yet, there are lots of other kinds of malware as well like e.g.backdoors or trojans or keyloggers etc pp.
Marie SWE wrote:
Fri Apr 05, 2019 6:59 pm
And isn't everybody saying that it is not possible to get infected with that kind of virus?
Well, most viruses are Windows viruses and therefore cannot infect Linux. There are hardly any Linux viruses around in the wild.
This does not mean that you could not be intrigued to install some kind of trojoan or backdoor on your Linux e.g.
It is also imaginable that security vulnerabilities in your internet browser can be exploited to run malicious code on your computer without your (unknowing) co-operation.
Marie SWE wrote:
Fri Apr 05, 2019 6:59 pm
just to clarify, no one has physical access to my computers.
Well. In the unlikely case that your computer is standalone with no connection to the internet, you can be reasonably sure only you have got access to the machine. At least if you keep it in a safe room at home only.
In case however you use your computer for surfing the web as well, physical access will not be required in order to gain access to your computer from outside.
How trivial or how complicated this is depends on a lot of factors. One such factor is how well incoming connection requests are rejected by your router. Another factor is how well your Linux account is protected against misusing. As mentioned above, if someone only needs to know your username, no password, then this someone's chances of hacking your computer from outside may not be so bad really.

So a strong password is like a good security lock on your front door. It helps keep intruders outside. Yet, if the windows are all wide open then an intruder does not need your key in order to invade your house.
The security of your computer system depends on a lot of factors. One is a password protected account. But there are a lot more factors. And be pretty sure the bad guys know better what the average user's weak points are than you or me.
Image
Linux Mint 18.1 64-bit Cinnamon Desktop, Total Commander 9.22a 64-bit
Ubuntu 18.04.2 32-bit Mate Desktop, Total Commander 9.22a 32-bit
Windows? - 1 window in every room

Marie SWE
Level 2
Level 2
Posts: 73
Joined: Wed Feb 28, 2018 7:32 pm
Location: Sweden

Re: No Password Needed Nor Wanted

Post by Marie SWE » Fri Apr 05, 2019 7:45 pm

bob466 wrote:
Fri Apr 05, 2019 7:20 pm
Some people just don't understand what security is... Image and that's the difference between Windoze and Linux but as always if you don't like it...go back to Windoze. Image
if you know how to block security holes and the weaknesses in windows and have advanced firewalls both hardware and software, then UAC is enough in windows if it is set to always notify. And of course you have an antivirus software.
and finally that the user does not do anything stupid... that also applies to linux users... the weakest link is usually the user
Not even the famous wannacry virus could infect my windows computer even that my antivirus program missed it.

So your comment "Some people just don't understand what security is" Then it doesn't matter if the user is using linux or windows, if they do not know what security is, so they allow software to install malicious code, either by clicking OK in UAC or verifying with its linux password
Nothing is impossible, the impossible just takes a little longer to complete...
It is like it is, because you do what you do, if you hadn't done as you did, it wouldn't have been as it is. ;)

User avatar
bob466
Level 4
Level 4
Posts: 484
Joined: Mon May 15, 2017 5:23 am
Location: Australia

Re: No Password Needed Nor Wanted

Post by bob466 » Fri Apr 05, 2019 8:03 pm

Marie SWE wrote:
Fri Apr 05, 2019 7:45 pm
bob466 wrote:
Fri Apr 05, 2019 7:20 pm
Some people just don't understand what security is... Image and that's the difference between Windoze and Linux but as always if you don't like it...go back to Windoze. Image
if you know how to block security holes and the weaknesses in windows and have advanced firewalls both hardware and software, then UAC is enough in windows if it is set to always notify. And of course you have an antivirus software.
and finally that the user does not do anything stupid... that also applies to linux users... the weakest link is usually the user
Not even the famous wannacry virus could infect my windows computer even that my antivirus program missed it.

So your comment "Some people just don't understand what security is" Then it doesn't matter if the user is using linux or windows, if they do not know what security is, so they allow software to install malicious code, either by clicking OK in UAC or verifying with its linux password
It seems you know very little about Linux...can you install Software...install Updates...Install Drivers...Roll Back a Kernel...or run a Command in the Terminal on my Computer ? No you can't because you need my Password...you can't even boot to my Desktop with out my Password that's Security...something you don't understand either. Image
Linux For Ever...Windoze Never Image

Marie SWE
Level 2
Level 2
Posts: 73
Joined: Wed Feb 28, 2018 7:32 pm
Location: Sweden

Re: No Password Needed Nor Wanted

Post by Marie SWE » Fri Apr 05, 2019 8:48 pm

Interesting
My biggest weakness is that i can't Linux at the same level as i know windows to block OS-holes........ yet.

karlchen wrote:
Fri Apr 05, 2019 7:40 pm
No, it does not require a virus and it does not require root privileges to start with. Acquiring root privileges on your computer may be the goal. But it would be the last step in gaining control of your system. The first step might be connecting to your computer using your account name. In case your account is not protected by a strong password, this will not be impossible, provided someone succeeds in finding out your loginname.
Okay, but to connect to my computer is either requires that my firewalls to be open and a backdoor in Linux Mint. Or that malicious software installs and manages to open an outbound connection that installs a remote desktop of my computer and creates a rule for incoming and outgoing traffic in my firewall and then can use my account name. Right or wrong?

karlchen wrote:
Fri Apr 05, 2019 7:40 pm
It is also imaginable that security vulnerabilities in your internet browser can be exploited to run malicious code on your computer without your (unknowing) co-operation.
I have taken all the steps i can to disable a few security holes in the browser with some well-chosen browser extensions (or is the correct word "add on")..and in the settings about:preferences and about:config

karlchen wrote:
Fri Apr 05, 2019 7:40 pm
One such factor is how well incoming connection requests are rejected by your router. Another factor is how well your Linux account is protected against misusing. As mentioned above, if someone only needs to know your username, no password, then this someone's chances of hacking your computer from outside may not be so bad really.
All incoming connections are rejected. I have configured my hardware firewall for that. I also have a false visible IP address with encrypted VPN.
Software firewall on every computer and some other things that I do not want to mention open.


karlchen wrote:
Fri Apr 05, 2019 7:40 pm
So a strong password is like a good security lock on your front door. It helps keep intruders outside. Yet, if the windows are all wide open then an intruder does not need your key in order to invade your house.
The security of your computer system depends on a lot of factors. One is a password protected account. But there are a lot more factors. And be pretty sure the bad guys know better what the average user's weak points are than you or me.
But why have locks on the inner doors, if the house outer doors is locked. or like a house in a gated community.
therefore I think that UAC can be enough to prevent malicious software to being stopped from being able to self install and require an active user intervention to click OK or Cancel to execute the installation


Now I miss that I can't fully English, so I can explain myself better what I really mean. :roll: :oops: :lol: :lol: :lol:
Last edited by Marie SWE on Fri Apr 05, 2019 9:00 pm, edited 1 time in total.
Nothing is impossible, the impossible just takes a little longer to complete...
It is like it is, because you do what you do, if you hadn't done as you did, it wouldn't have been as it is. ;)

Marie SWE
Level 2
Level 2
Posts: 73
Joined: Wed Feb 28, 2018 7:32 pm
Location: Sweden

Re: No Password Needed Nor Wanted

Post by Marie SWE » Fri Apr 05, 2019 8:57 pm

bob466 wrote:
Fri Apr 05, 2019 8:03 pm

It seems you know very little about Linux...can you install Software...install Updates...Install Drivers...Roll Back a Kernel...or run a Command in the Terminal on my Computer ? No you can't because you need my Password...you can't even boot to my Desktop with out my Password that's Security...something you don't understand either. Image
You can't install that in windows ether without click OK on UAC :wink:
so to use your own words. You don't know much about windows.

Yes. Linux is my biggest weakness. 5-6 active month
Microsoft OS. 31½ more years of knowledge than Linux.. So a big yes I know very little about Linux in compare

You can't start my windows computers either. It requires passwords, it requires you to have my house key and it requires you to turn off my alarm
Nothing is impossible, the impossible just takes a little longer to complete...
It is like it is, because you do what you do, if you hadn't done as you did, it wouldn't have been as it is. ;)

User avatar
catweazel
Level 18
Level 18
Posts: 8881
Joined: Fri Oct 12, 2012 9:44 pm
Location: Australian Antarctic Territory

Re: No Password Needed Nor Wanted

Post by catweazel » Fri Apr 05, 2019 9:41 pm

Marie SWE wrote:
Fri Apr 05, 2019 8:57 pm
You can't install that in windows ether without click OK on UAC :wink:
UAC = off
¡uʍop ǝpısdn sı buıɥʇʎɹǝʌǝ os ɐıןɐɹʇsnɐ ɯoɹɟ ɯ,ı

User avatar
bob466
Level 4
Level 4
Posts: 484
Joined: Mon May 15, 2017 5:23 am
Location: Australia

Re: No Password Needed Nor Wanted

Post by bob466 » Fri Apr 05, 2019 9:49 pm

Marie SWE wrote:
Fri Apr 05, 2019 8:57 pm
bob466 wrote:
Fri Apr 05, 2019 8:03 pm

It seems you know very little about Linux...can you install Software...install Updates...Install Drivers...Roll Back a Kernel...or run a Command in the Terminal on my Computer ? No you can't because you need my Password...you can't even boot to my Desktop with out my Password that's Security...something you don't understand either. Image
You can't install that in windows ether without click OK on UAC :wink:
so to use your own words. You don't know much about windows.

Yes. Linux is my biggest weakness. 5-6 active month
Microsoft OS. 31½ more years of knowledge than Linux.. So a big yes I know very little about Linux in compare

You can't start my windows computers either. It requires passwords, it requires you to have my house key and it requires you to turn off my alarm
You do realise I don't need a Password to Boot to your Windoze Computer Desktop and change/delete your files or install anything and it doesn't matter how long your Password is Image UAC or no UAC. Someone once said to me I have a very strong Password on my Windoze Computer and no one can open it...when I showed how easy it can be done his jaw dropped...the same thing can be done to a Linux Computer but the difference is...you can't change anything without a Password...that's the security of Linux. Image

Security on Windoze is a joke...Micro$oft could make Windoze as secure as Linux but choose not to...for a good reason $$$$$. Image

Anyway have a think on how I can do this and I'll tell you later...nothing illegal either. Image
Linux For Ever...Windoze Never Image

User avatar
jimallyn
Level 18
Level 18
Posts: 8904
Joined: Thu Jun 05, 2014 7:34 pm
Location: Wenatchee, WA USA

Re: No Password Needed Nor Wanted (Solved)

Post by jimallyn » Sat Apr 06, 2019 2:58 am

Marie SWE, it's your computer, and you are free to do with it as you like. But you won't find anybody here who will tell you that running with no password is a good idea. I wouldn't advise it either, but I recognize that some people just don't want to use a password, and that is their right. And if your computer gets screwed up because you refuse to use a password, people here will probably still help you fix it, and likely won't even say, "I told you so."

“There are three kinds of men: The ones that learns by reading. The few who learn by observation. The rest of them have to pee on the electric fence for themselves.” - Will Rogers
Image

“If the government were coming for your TVs and cars, then you'd be upset. But, as it is, they're only coming for your sons.” - Daniel Berrigan

User avatar
Pjotr
Level 21
Level 21
Posts: 12582
Joined: Mon Mar 07, 2011 10:18 am
Location: The Netherlands (Holland)
Contact:

Re: No Password Needed Nor Wanted (Solved)

Post by Pjotr » Sat Apr 06, 2019 4:44 am

It's rather tiresome to have to rub the noses of some people in the bloody obvious.... But it's worth the effort, lest they infect others with their harmful ideas.
Tip: 10 things to do after installing Linux Mint 19.1 Tessa
Keep your Linux Mint healthy: Avoid these 10 fatal mistakes
Twitter: twitter.com/easylinuxtips
All in all, horse sense simply makes sense.

rene
Level 10
Level 10
Posts: 3300
Joined: Sun Mar 27, 2016 6:58 pm

Re: No Password Needed Nor Wanted

Post by rene » Sat Apr 06, 2019 9:28 am

Marie SWE wrote:
Fri Apr 05, 2019 7:45 pm
Then it doesn't matter if the user is using linux or windows, if they do not know what security is, so they allow [ ... ]
Rest assured that bit of comment says that you understand the by far most important concept (i.e., all of this is overwhelmingly about psychology rather than technology) in fact better than any of the others who have replied into this thread :)

As to your question concerning possibility of UAC-like warning rather than password, it does seem this is not provided for by any standard means, no. Now, mind you, to me personally it would also be a bit of a hard sell to have it allow for it as I never considered warn-only UAC a good idea, given the frequency with which people need to click through confirmation dialogues on Windows anyway. I once watched an 11-year old install malware packaged in an IPTV program on Windows while commenting to me at each step: "then you just have to click "yes" here, and then it asks this, and you just say "yes", and then it works!". My disapproval of course garnered nothing but annoyed disappointment at the non-confirmation of his computer skills; he could watch the bit of foreign TV he wanted, could he not, so what on earth could I be complaining about?

Admittedly the specific 11-year old had a bit of a language issue as well, but I've seen the "normal" technology-unaware user do the exact same; not read or understand anything, but just click through. Learning how to operate a computer is to a very large part of the audience explicitly learning how to get Windows to butt out. Are you sure you wish to delete this file? Are you sure you wish to empty the recycle bin? Are you sure you wish to install this virus, err, oops, I meant this wonderful application that'll unlock all sorts of benefits for you?

So, not a fan of UAC warn-only and most definitely not in the manner in which it was (or perhaps even still is?) the default behaviour on Windows. But yes, on a definitively competent, single user system I would agree warn-only can make sense; no, don't believe there's any provision made for that on current Linux systems. I'd also note that that word "definitively" can be hard to come by in practice.

[EDIT] Slight adjustment, no provision made for that on current Ubuntu (-based) systems but that seems due to it for some reason shipping a wholly obsolete version of polkit (0.105). Newer versions of polkit allow for polkit.spawn() of an external helper in JavaScript .rules files which could be used to implement UAC-like behaviour, it seems.
Last edited by rene on Sun Apr 07, 2019 2:55 pm, edited 1 time in total.

User avatar
Pjotr
Level 21
Level 21
Posts: 12582
Joined: Mon Mar 07, 2011 10:18 am
Location: The Netherlands (Holland)
Contact:

Re: No Password Needed Nor Wanted

Post by Pjotr » Sat Apr 06, 2019 9:40 am

rene wrote:
Sat Apr 06, 2019 9:28 am
Marie SWE wrote:
Fri Apr 05, 2019 7:45 pm
Then it doesn't matter if the user is using linux or windows, if they do not know what security is, so they allow [ ... ]
Rest assured that bit of comment says that you understand the by far most important concept (i.e., all of this is overwhelmingly about psychology rather than technology) in fact better than any of the others who have replied into this thread
Now that's what I call a bloody presumption. This thread is about one particular security issue, namely the password. My reactions have, of course, focused on that.

I ask you not to spread unfounded nonsensical slander about my general outlook on security.
Tip: 10 things to do after installing Linux Mint 19.1 Tessa
Keep your Linux Mint healthy: Avoid these 10 fatal mistakes
Twitter: twitter.com/easylinuxtips
All in all, horse sense simply makes sense.

User avatar
catweazel
Level 18
Level 18
Posts: 8881
Joined: Fri Oct 12, 2012 9:44 pm
Location: Australian Antarctic Territory

Re: No Password Needed Nor Wanted

Post by catweazel » Sat Apr 06, 2019 9:43 am

rene wrote:
Sat Apr 06, 2019 9:28 am
Rest assured that bit of comment says that you understand the by far most important concept (i.e., all of this is overwhelmingly about psychology rather than technology) in fact better than any of the others who have replied into this thread :)
How to lose friends and alienate people 101.
¡uʍop ǝpısdn sı buıɥʇʎɹǝʌǝ os ɐıןɐɹʇsnɐ ɯoɹɟ ɯ,ı

rene
Level 10
Level 10
Posts: 3300
Joined: Sun Mar 27, 2016 6:58 pm

Re: No Password Needed Nor Wanted

Post by rene » Sat Apr 06, 2019 9:44 am

catweazel wrote:
Sat Apr 06, 2019 9:43 am
How to lose friends and alienate people 101.
What friends? :)

User avatar
catweazel
Level 18
Level 18
Posts: 8881
Joined: Fri Oct 12, 2012 9:44 pm
Location: Australian Antarctic Territory

Re: No Password Needed Nor Wanted

Post by catweazel » Sat Apr 06, 2019 9:48 am

rene wrote:
Sat Apr 06, 2019 9:44 am
catweazel wrote:
Sat Apr 06, 2019 9:43 am
How to lose friends and alienate people 101.
What friends? :)
Don't worry too much. You never know what luck might come your way. Someone might bequeath one to you in their will.
¡uʍop ǝpısdn sı buıɥʇʎɹǝʌǝ os ɐıןɐɹʇsnɐ ɯoɹɟ ɯ,ı

rene
Level 10
Level 10
Posts: 3300
Joined: Sun Mar 27, 2016 6:58 pm

Re: No Password Needed Nor Wanted (Solved)

Post by rene » Sat Apr 06, 2019 10:03 am

Marie asked a technical question, but my compliment to her rather than the discussion of said question is all that is deemed interesting by by now two people. I will admit to considering that to be fairly potent sign of not everyone being here in this thread, in any thread such as this, for the correct reasons -- this time technology rather than psychology. But shall leave it at that as to anything other than the actual question...

jchelpau
Level 3
Level 3
Posts: 100
Joined: Mon Mar 25, 2019 11:19 pm
Location: Australia
Contact:

Re: No Password Needed Nor Wanted (Solved)

Post by jchelpau » Sat Apr 06, 2019 5:04 pm

It's worth noting that passwordless UAC is not considered a security boundary in Windows.
Neither would passwordless sudo in Linux.

rene
Level 10
Level 10
Posts: 3300
Joined: Sun Mar 27, 2016 6:58 pm

Re: No Password Needed Nor Wanted (Solved)

Post by rene » Sat Apr 06, 2019 6:28 pm

Honest question, what does that in fact mean in practice? It certainly seems to be the case that I can definitively destroy a Windows 7 system through passwordless UAC.

Post Reply

Return to “Newbie Questions”