No Password Needed Nor Wanted (Solved)

[Larry78723]

Marie, apparently you don't agree with the first of your own signature lines.

[bob466]

Some people just don't understand what security is... and that's the difference between Windows and Linux but as always if you don't like it...go back to Windows.

[Marie SWE]

Marie, apparently you don't agree with the first of your own signature lines.

Of course I do
But it is just as easy to use a keylogger to capture the password as creating a virus that can click OK on a screen

[karlchen]

Okay, if anyone is gaining control of my computer. Doesn't that requires a virus with root privileges?

No, it does not require a virus and it does not require root privileges to start with. Acquiring root privileges on your computer may be the goal. But it would be the last step in gaining control of your system. The first step might be connecting to your computer using your account name. In case your account is not protected by a strong password, this will not be impossible, provided someone succeeds in finding out your loginname.

About viruses:
A lot of users tend to call any malware viruses. This is incorrect, however. Like a biological virus, a computer virus is a kind of malware which can replicate itself. Yet, there are lots of other kinds of malware as well like e.g.backdoors or trojans or keyloggers etc pp.

And isn't everybody saying that it is not possible to get infected with that kind of virus?

Well, most viruses are Windows viruses and therefore cannot infect Linux. There are hardly any Linux viruses around in the wild.
This does not mean that you could not be intrigued to install some kind of trojoan or backdoor on your Linux e.g.
It is also imaginable that security vulnerabilities in your internet browser can be exploited to run malicious code on your computer without your (unknowing) co-operation.

just to clarify, no one has physical access to my computers.

Well. In the unlikely case that your computer is standalone with no connection to the internet, you can be reasonably sure only you have got access to the machine. At least if you keep it in a safe room at home only.
In case however you use your computer for surfing the web as well, physical access will not be required in order to gain access to your computer from outside.
How trivial or how complicated this is depends on a lot of factors. One such factor is how well incoming connection requests are rejected by your router. Another factor is how well your Linux account is protected against misusing. As mentioned above, if someone only needs to know your username, no password, then this someone's chances of hacking your computer from outside may not be so bad really.

So a strong password is like a good security lock on your front door. It helps keep intruders outside. Yet, if the windows are all wide open then an intruder does not need your key in order to invade your house.
The security of your computer system depends on a lot of factors. One is a password protected account. But there are a lot more factors. And be pretty sure the bad guys know better what the average user's weak points are than you or me.

[Marie SWE]

Some people just don't understand what security is... and that's the difference between Windows and Linux but as always if you don't like it...go back to Windows.

if you know how to block security holes and the weaknesses in windows and have advanced firewalls both hardware and software, then UAC is enough in windows if it is set to always notify. And of course you have an antivirus software.
and finally that the user does not do anything stupid... that also applies to linux users... the weakest link is usually the user
Not even the famous wannacry virus could infect my windows computer even that my antivirus program missed it.

So your comment "Some people just don't understand what security is" Then it doesn't matter if the user is using linux or windows, if they do not know what security is, so they allow software to install malicious code, either by clicking OK in UAC or verifying with its linux password

[bob466]

Some people just don't understand what security is... and that's the difference between Windows and Linux but as always if you don't like it...go back to Windows.

if you know how to block security holes and the weaknesses in windows and have advanced firewalls both hardware and software, then UAC is enough in windows if it is set to always notify. And of course you have an antivirus software.
and finally that the user does not do anything stupid... that also applies to linux users... the weakest link is usually the user
Not even the famous wannacry virus could infect my windows computer even that my antivirus program missed it.

So your comment "Some people just don't understand what security is" Then it doesn't matter if the user is using linux or windows, if they do not know what security is, so they allow software to install malicious code, either by clicking OK in UAC or verifying with its linux password

It seems you know very little about Linux...can you install Software...install Updates...Install Drivers...Roll Back a Kernel...or run a Command in the Terminal on my Computer ? No you can't because you need my Password...you can't even boot to my Desktop with out my Password that's Security...something you don't understand either.

[Marie SWE]

Interesting
My biggest weakness is that i can't Linux at the same level as i know windows to block OS-holes........ yet.

No, it does not require a virus and it does not require root privileges to start with. Acquiring root privileges on your computer may be the goal. But it would be the last step in gaining control of your system. The first step might be connecting to your computer using your account name. In case your account is not protected by a strong password, this will not be impossible, provided someone succeeds in finding out your loginname.

Okay, but to connect to my computer is either requires that my firewalls to be open and a backdoor in Linux Mint. Or that malicious software installs and manages to open an outbound connection that installs a remote desktop of my computer and creates a rule for incoming and outgoing traffic in my firewall and then can use my account name. Right or wrong?

It is also imaginable that security vulnerabilities in your internet browser can be exploited to run malicious code on your computer without your (unknowing) co-operation.

I have taken all the steps i can to disable a few security holes in the browser with some well-chosen browser extensions (or is the correct word "add on")..and in the settings about:preferences and about:config

One such factor is how well incoming connection requests are rejected by your router. Another factor is how well your Linux account is protected against misusing. As mentioned above, if someone only needs to know your username, no password, then this someone's chances of hacking your computer from outside may not be so bad really.

All incoming connections are rejected. I have configured my hardware firewall for that. I also have a false visible IP address with encrypted VPN.
Software firewall on every computer and some other things that I do not want to mention open.

So a strong password is like a good security lock on your front door. It helps keep intruders outside. Yet, if the windows are all wide open then an intruder does not need your key in order to invade your house.
The security of your computer system depends on a lot of factors. One is a password protected account. But there are a lot more factors. And be pretty sure the bad guys know better what the average user's weak points are than you or me.

But why have locks on the inner doors, if the house outer doors is locked. or like a house in a gated community.
therefore I think that UAC can be enough to prevent malicious software to being stopped from being able to self install and require an active user intervention to click OK or Cancel to execute the installation


Now I miss that I can't fully English, so I can explain myself better what I really mean.

[Marie SWE]

It seems you know very little about Linux...can you install Software...install Updates...Install Drivers...Roll Back a Kernel...or run a Command in the Terminal on my Computer ? No you can't because you need my Password...you can't even boot to my Desktop with out my Password that's Security...something you don't understand either.

You can't install that in windows ether without click OK on UAC
so to use your own words. You don't know much about windows.

Yes. Linux is my biggest weakness. 5-6 active month
Microsoft OS. 31½ more years of knowledge than Linux.. So a big yes I know very little about Linux in compare

You can't start my windows computers either. It requires passwords, it requires you to have my house key and it requires you to turn off my alarm

[catweazel]

You can't install that in windows ether without click OK on UAC

UAC = off

[bob466]

It seems you know very little about Linux...can you install Software...install Updates...Install Drivers...Roll Back a Kernel...or run a Command in the Terminal on my Computer ? No you can't because you need my Password...you can't even boot to my Desktop with out my Password that's Security...something you don't understand either.

You can't install that in windows ether without click OK on UAC
so to use your own words. You don't know much about windows.

Yes. Linux is my biggest weakness. 5-6 active month
Microsoft OS. 31½ more years of knowledge than Linux.. So a big yes I know very little about Linux in compare

You can't start my windows computers either. It requires passwords, it requires you to have my house key and it requires you to turn off my alarm

You do realise I don't need a Password to Boot to your Windows Computer Desktop and change/delete your files or install anything and it doesn't matter how long your Password is UAC or no UAC. Someone once said to me I have a very strong Password on my Windows Computer and no one can open it...when I showed how easy it can be done his jaw dropped...the same thing can be done to a Linux Computer but the difference is...you can't change anything without a Password...that's the security of Linux.

Security on Windows is a joke...Microsoft could make Windows as secure as Linux but choose not to...for a good reason $$$$$.

Anyway have a think on how I can do this and I'll tell you later...nothing illegal either.

[jimallyn]

Marie SWE, it's your computer, and you are free to do with it as you like. But you won't find anybody here who will tell you that running with no password is a good idea. I wouldn't advise it either, but I recognize that some people just don't want to use a password, and that is their right. And if your computer gets screwed up because you refuse to use a password, people here will probably still help you fix it, and likely won't even say, "I told you so."

“There are three kinds of men: The ones that learns by reading. The few who learn by observation. The rest of them have to pee on the electric fence for themselves.” - Will Rogers

[Pjotr]

It's rather tiresome to have to rub the noses of some people in the bloody obvious.... But it's worth the effort, lest they infect others with their harmful ideas.

[rene]

Then it doesn't matter if the user is using linux or windows, if they do not know what security is, so they allow [ ... ]

Rest assured that bit of comment says that you understand the by far most important concept (i.e., all of this is overwhelmingly about psychology rather than technology) in fact better than any of the others who have replied into this thread

As to your question concerning possibility of UAC-like warning rather than password, it does seem this is not provided for by any standard means, no. Now, mind you, to me personally it would also be a bit of a hard sell to have it allow for it as I never considered warn-only UAC a good idea, given the frequency with which people need to click through confirmation dialogues on Windows anyway. I once watched an 11-year old install malware packaged in an IPTV program on Windows while commenting to me at each step: "then you just have to click "yes" here, and then it asks this, and you just say "yes", and then it works!". My disapproval of course garnered nothing but annoyed disappointment at the non-confirmation of his computer skills; he could watch the bit of foreign TV he wanted, could he not, so what on earth could I be complaining about?

Admittedly the specific 11-year old had a bit of a language issue as well, but I've seen the "normal" technology-unaware user do the exact same; not read or understand anything, but just click through. Learning how to operate a computer is to a very large part of the audience explicitly learning how to get Windows to butt out. Are you sure you wish to delete this file? Are you sure you wish to empty the recycle bin? Are you sure you wish to install this virus, err, oops, I meant this wonderful application that'll unlock all sorts of benefits for you?

So, not a fan of UAC warn-only and most definitely not in the manner in which it was (or perhaps even still is?) the default behaviour on Windows. But yes, on a definitively competent, single user system I would agree warn-only can make sense; no, don't believe there's any provision made for that on current Linux systems. I'd also note that that word "definitively" can be hard to come by in practice.

[EDIT] Slight adjustment, no provision made for that on current Ubuntu (-based) systems but that seems due to it for some reason shipping a wholly obsolete version of polkit (0.105). Newer versions of polkit allow for polkit.spawn() of an external helper in JavaScript .rules files which could be used to implement UAC-like behaviour, it seems.

[Pjotr]

Then it doesn't matter if the user is using linux or windows, if they do not know what security is, so they allow [ ... ]

Rest assured that bit of comment says that you understand the by far most important concept (i.e., all of this is overwhelmingly about psychology rather than technology) in fact better than any of the others who have replied into this thread

Now that's what I call a bloody presumption. This thread is about one particular security issue, namely the password. My reactions have, of course, focused on that.

I ask you not to spread unfounded nonsensical slander about my general outlook on security.

[catweazel]

Rest assured that bit of comment says that you understand the by far most important concept (i.e., all of this is overwhelmingly about psychology rather than technology) in fact better than any of the others who have replied into this thread

How to lose friends and alienate people 101.

[rene]

How to lose friends and alienate people 101.

What friends?

[catweazel]

How to lose friends and alienate people 101.

What friends?

Don't worry too much. You never know what luck might come your way. Someone might bequeath one to you in their will.

[rene]

Marie asked a technical question, but my compliment to her rather than the discussion of said question is all that is deemed interesting by by now two people. I will admit to considering that to be fairly potent sign of not everyone being here in this thread, in any thread such as this, for the correct reasons -- this time technology rather than psychology. But shall leave it at that as to anything other than the actual question...

[jchelpau]

It's worth noting that passwordless UAC is not considered a security boundary in Windows.
Neither would passwordless sudo in Linux.

[rene]

Honest question, what does that in fact mean in practice? It certainly seems to be the case that I can definitively destroy a Windows 7 system through passwordless UAC.