Isn’t it enough to just enter your password once to login, then receive a warning whenever you’re about to do something potentially dangerous?
If it’s such a big security risk, how come the most popular and widely used operating systems in the world and their users seem to be unaffected by it?
I guarantee, most new users coming to Linux from Windows/macOS are going to laugh and look at you funny if you try to justify entering your password again and again and again.
macos you do
microsoft doesnt want to annoy people, but in a corporate environment this requirement is fully implemented on windows.
i was never under the impression macs belonged in a business environment. maybe apple just doesnt find that level of security important.
deleted by creator
Thank you for the informative response. I was unaware Windows machines employed similar behavior in corporate environments.
Do you think, then, that it would be acceptable for Linux to remove these restrictions in home environments?
You are more than welcome to remove the need for any passwords at all on the linux systems you admin. Good thing about free software is that you decide how you want it, hack up or put up.
no. no reason to expand poor practices into linux because microsoft fucked up. we need ‘least access required’ methodology even at home because the world is full of bad actors.
if microsoft had correclty implemented security into dos/winx.x we wouldnt have had half the virus issues we did in the late 90s.
i think the other half was caused by activex
I don’t think the security issues with windows stem from not having the user enter their password a bunch of times.
deleted by creator
deleted by creator
It’s Linux. You can remove the restriction yourself.
It’s not that hard to either give your user account perma-sudo or to remove the timeout so you only have to enter the password once per login. Slightly more involved would be manually changing which actions require root authentication.
If it’s such a big security risk, how come the most popular and widely used operating systems in the world and their users seem to be unaffected by it?
Are they though? My corporate managed Windows machine either refuses an elevated command or asks me for my password/fingerprint. Same with macOS. Just because you don’t secure your Windows machine doesn’t mean other do the same.
I guarantee, most new users coming to Linux from Windows/macOS are going to laugh and look at you funny if you try to justify entering your password again and again and again.
the least pressing concern for any Windows/macOS user. Besides, you can install user-wide application without any password requirement, if you want to change something on system level (and lets face it, when does a regular user does that on a regular basis?) you need to have some sort of security.
You can easily fine tune what requires a password in Linux by editing the /etc/sudoers file.
On macOS you need to do that quite a couple of times. Changing settings, installing stuff to run in the background, install stuff to open open login, etc. So it is there. Furthermore a lot of programs and guides for linux are written to make it easy so they use
sudobut you don’t always have to run it as root. But not doing so usually requires more steps. So linux is more restricting but to circumvent that, people usesudoa bit too much.deleted by creator
deleted by creator
deleted by creator
deleted by creator
It just ain’t rock and roll
FYI, you don’t need to either on linux. Look up sudo.
Then why is it when I use sudo, it asks for my password? Huh? Yeah, if I’m quick and run another sudo command within a minute or whatever the time limit is I don’t need to enter it again, but it usually times out by the time whatever I was doing finishes.
real power users just enter blind every sudo command they have to perform for the day while the first one is running. Keep up.
Well evidently you didn’t look up sudo. There is a sudoers file where you set up commands that can be run by users without asking for a password. It is very detailed and can go from anyone with sudo access can run anything without a password prompt to user x can only run a certain command with certain command line options. There’s some serious lack of experience showing in this thread. Thinking about it, yeah, better yet, stay away from sudo if you can’t grasp basic admin functions.
There are a lot of people just getting into Linux that are here to learn. Take your gatekeeping bullshit and shove it up your ass.
Take a pill there… How would you like them to learn? By running some command with sudo that they don’t understand and blowing away their system? Because that’s what can happen if you don’t understand what you are doing. It’s not gatekeeping, it’s being realistic with what can be done when you are playing around with things like sudo.
Mac uses TouchID for the most part in the GUI, but CLI sudo still asks for your login password, although it can be configured to ask for TouchID as well. The GUI does fallback to having you enter your password if somehow you have a Mac without TouchID.
Windows uses the UAC thing which currently we don’t have a great way to do on Linux but should be possible with Wayland (on Xorg you’d just need to script clicking yes and bypass user approval because there’s no security). On Windows when the UAC popup pops up and you click yes, you’ve done the equivalent of entering your password. In enterprise settings, it’s not common for it to be configured to actually ask your password, or ask the password of an admin account. So no it’s not “good enough” even on Windows under some situations.
On Linux you can configure sudo to use the fingerprint reader or a security key if you want. PAM stands for Pluggable Authentication Module, you can do whatever you want. You can also make it no password at all and sudo just automatically gives you root no questions asked.
The security use case is to prevent software running as your user to have an easy path to getting to root without some form of user approval. That also means if you walk off your desk to refill your coffee nobody can sneak behind you and plop a USB with malware, click yes and leave.
It’s doable on Linux with some PAM and Polkit tweaks, just not how it’s shipped by default because it’s better users voluntarily reduce their security settings than defaulting to minimal security like Windows used to (in particular the XP days before UAC, and UAC did annoy a lot of people when it came in with Vista and 7).
I guarantee, most new users coming to Linux from Windows/macOS are going to laugh and look at you funny if you try to justify entering your password again and again and again.
That’s nice, but this ain’t MacOS or Windows. This is Linux.
Sorry but 20 years of “but this isn’t exactly like Winders11!!!one!” starts to grate on me. It’s a different OS with a different philosophy and a different workflow. Everbody coming from Windows had to learn to deal with the nuances of that OS as well, nuances they’ve completely forgotten about because it’s second nature.
I don’t WANT Linux to be exactly like MacOS and Windows. I want it to stand on its own, with its own ideas on how to run a computer.
Yeah, but you gotta admit it’s possible windows does some things better.
I also think a lot of linux users get tunnel-visioned and believe that something is incorrect simply because it’s how another OS does it.
Oh yeah, there are advantages to each, despite the bickering and camps we put ourselves into. It all comes down to what abilities you’re gonna lose, and what you’re gonna gain when making the decision.
For me, I rarely game, and I do a lot of hobby electronics and programming, so Linux is a good fit. There’s so many cool open source programmer utilities out there.
For my wife, it fits not so much.
Windows is historically a “single user OS” whereas Linux is historically a multi-user OS. They’re both multi-user now but the philosophy of these backgrounds results in what you see today.
So under Windows you login “as an admin” and don’t need passwords for many things - similar to (but very much not the same as) running Linux as root.
Under Linux you login “as a user” and need to elevate permissions for things which can affect other users on the same system. Typically with sudo these days.
These lines are very much blurring so you can do many things under Linux without a password and some things on Windows require “running powershell as an admin”.
NT (and therefore all Windows versions today) always had multi-user security. It’s essentially a ported version of DEC Alpha.
On install, the first user is admin, just like the first Linux account is root, or else you wouldn’t be able configure the machine.
Windows architecture built on DOS (3.x, 95,etc) lacked any such security, and was developed as a single-user OS (goes back to DOS86).
Yeah, and NT was pretty much just a corporate and government thing throughout the 90s. It wasn’t until XP that home users got it on the desktop, and even then, the first user created automatically had all admin rights, because people were still used to the Win9x/DOS way of doing things. Separation of different accounts with different privilege levels wasn’t a widespread practice up until maybe Windows Vista.
NT (and therefore all Windows versions today) always had multi-user security. It’s essentially a ported version of DEC Alpha.
- DEC Alpha is a hardware not a software.
- I know that WinNT had multi-user capabilities, but I’ve simplified for conversation.
I have to do this on both macOS and windows…
You can turn it off but you probably shouldn’t.
You do need to authorize admin action on Windows and it causes severe security issues, because people do it without thinking all the time.
You can also configure Linux to have this behaviour, but for security reasons it works differently out of the box. Also, some programs, such as many terminal emulators, can cache you PW so you don’t have to enter it multiple times.
I use a U2F key for sudo and it’s just one touch. One touch you need to sit in front of my computer for.
Also, some programs, such as many terminal emulators, can cache you PW so you don’t have to enter it multiple times.
Terminal emulators don’t (or at least shouldn’t) do any such thing. sudo itself is responsible for letting you do privilege escalation without password for some time after successfully passing once - whenever you run it and successfully authenticate, it saves your user id, current time and a session identifier (each open shell gets a unique identifier) into a file. Then, when you attempt to do anything, it will check this file to see if you’ve if you’ve authenticated within the last few minutes in this terminal, and only ask for a password if you haven’t.
For more info, see
man sudoers_timestampdeleted by creator
It’s not true admin privileges, windows won’t let you delete system32 the normal way, Linux on the other hand will tell you good luck and bail as you delete everything
“You know what’s funnier? That theatrics you call User Access Control popup.”
AFAIK the user account created by default on windows will be a full privilege account, so won’t need a password to gain admin through UAC. Essentially the same as Linux where you can gain root privileges through sudo by using your own password.
But if you create an account with standard user privileges it will ask your for the password to an administrator account to gain admin. I’m not sure what the linux equivalent of this would be, denying sudo access would be too restrictive so maybe there’s an in between where you need the password to an admin user to gain sudo.
The linux equivalent would probably be using
suto switch to an account with sudo access or straight-up to root.
