I want to make Linux my main OS. I’ve used Windows for decades. Since Vista or 7, the Windows security model is this, from what I understand:
- unprivileged programs have limited/no ability to do scary things to your computer. they might be able to read some data, but it’s not going to implant malware in the boot sequence for Windows.
- if a program wants escalation, it triggers a UAC popup and the user has to accept it. Remote programs cannot accept UAC on a physical person’s behalf. Escalated programs have admin level control and can do the scary things.
- As with any OS, there may be privilege escalation vulnerabilities that escalate (1) into (2).
I’ve only had Windows malware a few times since Win7, and the entry point was fairly avoidable. (Running a sketchy EXE, and a possible drive-by malware install via an advertisement. I could never prove the latter.)
I have never run a password on my Windows machines.
On any system, physical access is game over.
On Linux, the password is paramount. I’ve tried to understand the security model and I keep failing. Synthesizing from arch wiki
SSH
Equivalent to local physical access as the user. If it’s a sudoers or root account, it can do scary things. Not a threat if ssh is disabled or well secured (password or key pairs).
If a network has a well configured firewall (on the router), it should block ssh requests from outside the network unless the admin specifically wants SSH outside the network.
As with any OS, there may be bugs that allow remote access outside of SSH.
Local login / password prompts to physical users
Without a password, you can’t escalate to root and install new software. Some software, often dealing with hardware (smartctl) requires sudo/root to run.
Encrypted drives
Passwords can decrypt drives if they are encrypted.
Keyrings
Some DEs (KDE) offer a ‘keyring’ that stores passwords. It’s locked/encrypted with a password, usually the same as the login password.
So what am I missing? Is Windows + UAC + no password secure? What is Linux protecting us from by using passwords?
I think the basic premise of this question, that Windows and Linux somehow have a different foundational security model that is or isn’t based on passwords, is not really true. Passwords play more or less the same role for any modern operating system – be it Linux, MacOS, Android, iOS, etc.
The only major difference is that instead of UAC, Linux has a variety of options (sudo, policykit, run0), which are implemented differently across different distributions. If your privileged user doesn’t have a password, in some cases this could lead to any program being able to elevate their privilege quietly, unlike UAC.
However, in many distributions you can set up a user with a password and enable passwordless local login, which would be almost equivalent to windows with no password.
Answering your question directly, the major threat to most consumer users is physical compromise or theft of device. Your statement that “physical access is game over” is not entirely accurate: disk encryption with a password is a very strong protection against unauthorized data access, but you need to use a password (doesn’t matter if it’s Linux or Windows).
Not really sure what you’re asking here
Is Windows + UAC + no password secure?
No.
What is Linux protecting us from by using passwords?
Bad humans & mistakes. But Linux doesn’t need passwords.
Linux & Windows came from a command-line history, so things like UAC are just a GUI version of
sudo(and there is (was?) a Linux equivalent if you wanted it)So, consider these as options on either OS. If you want it, it’s there, if you don’t, don’t - other options exist depending on your uae case (ie SSH keys, biometrics, etc…)
To the point; not using a password is a choice on convenience over protection.
Linux & Windows came from a command-line history, so things like UAC are just a GUI version of sudo (and there is (was?) a Linux equivalent if you wanted it)
Can confirm that the GUI versions of sudo (and similar privilege escalation interface) exist on Linux, at least for KDE, in the form of kdesu.
What are passwordless solutions in Windows for remote access, disk/filesystem encryption, keyrings?
BTW in all that cases a password can be replaced with a hardware token, for instance. It is just the simplest, most widely used and one of the less secure options.
Physical access isn’t game over, it’s only game over to a determined hacker. The vast majority of people aren’t competent enough for it to be an issue. It’s just like how a determined thief can get through almost any lock or door, but it takes effort and time, and skill which many casuals just won’t have.
Full-disk encryption passwords are the most important password, they can prevent physical access from being game-over.
Unix was originally designed to be multi-user, so different passwords protect different users from each other.
Linux doesn’t have a UAC-without-passwords equivalent really, programs can interact with the Linux UAC equivalents just as much as you can, so the password makes sure it’s really you, and not a malicious program or person. UAC on Linux would require an almost fundamental architecture change, in a way contrary to most of how Linux is used now.
Did you really never use a password with Windows? That seems wild to me.
UAC on Linux would require an almost fundamental architecture change, in a way contrary to most of how Linux is used now.
I would say the challenge is not in the architecture, but in the general fragmentation of the ecosystem. PolicyKit is basically an equivalent to UAC, but it’s not used universally by everything that needs elevated access.
The idea of not having a password at all is just so foreign to me, did you at least use biometrics or something?
It seems like not having a password would make some UAC bypasses easier, too.
I never used a password on Windows because I’ve never seen a reason for one. No one touches my computer. That’s what the physical locks on my doors are for.
I only use a password in Linux because it forces me to. The first thing I tried to do was disable it.
Nobody lives with you? Or visits you? You don’t use a laptop ever? What if someone does get through your locks?
You can set empty password up pretty easily, so you’ll just press enter to get through password prompts, just like how you’d click through password-less UAC prompts. Richard Stallman used to recommend that way back in the 80’s, on the big shared University machines.
I highly recommend a full-disk-encryption password even if you don’t have a traditional computer password, it’ll keep your data extra safe. Imagine the feds raid your house because Hexbear got designated a Foreign Terrorist Organization, the feds couldn’t get any Hexbear data off of the disk if it’s locked.
But it really feels like even if a password doesn’t add much security-wise, there’s basically no downside to it. My password is pretty long by conventional standards, but it takes a small fraction of a second to type it all out and login.
Nobody lives with you?
My grandmother, who has no interest in my computer.
Or visits you?
No
You don’t use a laptop ever?
No
What if someone does get through your locks?
What if someone guesses your password? Why don’t you keep your computer in a custom built safe bolted to the floor? There’s always another level of security you could hypothetically require, I just live in reality where the truth is no one is touching my computer.
there’s basically no downside to it.
It takes a second or so every time (sometimes a couple of seconds, I’m not always booting my computer with the intent to type shit immediately) which adds up over time. Sometimes I mistype, wasting 10+ seconds. And the benefit of this mild inconvenience is nothing.
Any OS with no password is insecure. Hands down.
Linux/Unix has a permissions structure that works at the filesystem level, to be really brief about it.
Files are owned by users. Users can be part of groups to represent a larger number of users for simple organization.
Regular users can only touch files they own, or are owned by a group they are in. Root has master permissions to anything.
As a regular user, your home directory is owned by you. Anything you create is owned by you. All programs executed by you require that you have permissions to those things. Therefore if you’re just bouncing on the system and doing things, you can only harm the files that you own.
Your account having a password prevents access to this account. Though it’s a regular user, anyone with that password can harm your files.
The Root password allows anyone to execute or delete any files on the system. Anyone with this password can get to any file on the system, so you never let anyone know this password.
Your assumption that SSH somehow has different passwords is incorrect. You make a user on a machine and you don’t prevent SSH access…then they can SSH in, but they’re still a regular user.
Relevant xkcd: https://xkcd.com/1200/
It’s there to protect you from crimes of opportunity. Like if your car is locked, a thief could decide to pick the lock, smash the windows in, or find another victim, but they would have no second thoughts if your car were already unlocked. The password deters a casual hacker and buys you some time to notice and deal with anyone seriously trying to break in.
In an ideal case of disk encryption and a well-designed lock screen, the password forces a would-be intruder to either spend lots of time guessing it or shut down the computer, thereby discarding the encryption key from memory and thwarting the attack.
I don’t use Windows often, so I might be missing some context - every Windows computer I’ve used has an account with a password that I need to type in sometimes, though admittedly not for every privileged operation. They prevent most people with physical access from doing anything, in the same way that the locks on your doors or windows do. Opportunistic actors are prevented from access.
Most Linux distros probably tend to prompt you to actually type in your password more often, but:
- SSH: if you aren’t connecting to your computer via SSH you have no reason to be running an SSH Server. In most cases, you should be using a key pair for auth, and the password for the key (if set) is what you’re typing in. This provides a layer of security beyond what a password-less key pair offers because physical access to your private key no longer grants access to the remote system without the password.
- Encrypted drives: similarly adds a layer on top of physical access necessary to decrypt the data
- Keyrings: password re-use is a bad thing, and re-using your login password for what amounts to a password manager is also not great practice, though admittedly relatively common
This may or may not help, but here’s my two cents:
Windows was originally built to be as user-friendly as possible because its target audience are non-tech-savvy people. It then evolved into being a business OS. So security was never its first priority.
UNIX was built for tech savvy people to do business-sensitive stuff, and required sophisticated security models. Linux was modeled after UNIX (Minix specifically), and thus inherited those same principles. It evolved to become more user friendly. But security remained a priority.
Now, that said, both Windows and Linux are configurable. You can make Windows more secure with effort, just like you can make Linux less secure with effort (and I don’t mean simply using root all the time).
There are diehards on both sides , and they will make excellent (or terrible) arguments for their favored OS. So you need to decide what works best for you and your use case and go with that. 😊
I always just run anything that asks for it with sudo, and I probably shouldn’t. I wish my software installations (on any device) came with a set of required or requested permissions (with the option to say no). I want to know what I’m letting my software installs do.
flatpak can do that
I don’t believe there is any particular advantage of linux insisting on password input for privilege escalation. Obviously there is no proof of this, but I suspect that the design of this privilege escalation flow in linux is at least partly caused by its popularity as a server OS, for example the UI flow for Windows UAC wouldn’t work if you’re trying to remotely administrate a server through the terminal.
Is Windows + UAC + no password secure?
It should be, in fact I believe that by default if your local admin account doesn’t have a password set, remote logins and run-as is disabled for that account so you might even be able to argue that it is more secure. It’s probably one of the reasons why Windows 11 comes with a recommended option to disable passwords and only authenticate through Windows Hello.
No, that recommend is because your biometrics are worth more to Microsoft than a random password, and they want to push it to seem more friendly to noob users who they’ll push towards a Microsoft online account instead of a local account.
You can use windows hello without biometrics.
