Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A fork of sudo with Touch ID support

github.com

Post reply on HN
Print view View original

31–40 of 134 posts

Re: Show HN: A fork of sudo with Touch ID support

#31

Post by besselheim »

TekMol wrote: post #24
woodruffw wrote: post #18

Earlier quoted context omitted.

Isolate your concerns and risks. There's no reason to drop into an interactive root shell for a single command, and your chances of forgetting your current privilege level and running the wrong thing are not insignificant.

What special "wrong thing" can root do? There might os level files that only root can edit or delete. I don't care about those. I can reinstall the os anytime if I should ever mess it up. All the value is in my data.

One example relating to OS X is that malware running as root can defeat anti-keylogger protections such as this: https://developer.apple.com/library/content/technotes/tn2150...

If you were running your web browser as root, and a malicious website used a vulnerability to drop some malware on your system, then it would have complete power to do what it liked without needing to escalate privilege using another vulnerability.

Re: Show HN: A fork of sudo with Touch ID support

#32

Post by ajdlinux »

TekMol wrote: post #24
woodruffw wrote: post #18

Earlier quoted context omitted.

Isolate your concerns and risks. There's no reason to drop into an interactive root shell for a single command, and your chances of forgetting your current privilege level and running the wrong thing are not insignificant.

What special "wrong thing" can root do? There might os level files that only root can edit or delete. I don't care about those. I can reinstall the os anytime if I should ever mess it up. All the value is in my data.

When you're doing maintenance on a production environment which is serving hundreds or thousands of customers, in many cases you can't just "reinstall the OS anytime". Sure, ideally your environment is set up with redundancy and you fail over nicely, but still...

Re: Show HN: A fork of sudo with Touch ID support

#33

Post by zwegner »

droopyEyelids wrote: post #11

You two are both doing the "ATM machine" thing. (PAM = Pluggable Authentication Module) "Written as a PAM" sure feels wrong on the lips, though.

Also known as PNS Syndrome (PIN Number Syndrome (Personal Identification Number Number Syndrome Syndrome)).

Re: Show HN: A fork of sudo with Touch ID support

#34

Post by woodruffw »

TekMol wrote: post #24
woodruffw wrote: post #18

Earlier quoted context omitted.

Isolate your concerns and risks. There's no reason to drop into an interactive root shell for a single command, and your chances of forgetting your current privilege level and running the wrong thing are not insignificant.

What special "wrong thing" can root do? There might os level files that only root can edit or delete. I don't care about those. I can reinstall the os anytime if I should ever mess it up. All the value is in my data.

For most people, accidentally destroying various system files and "only" having to reinstall the OS would be considered a serious inconvenience.

If you want an example of something that could cause lasting damage, it's probably pretty easy to put your Apple product into a non-booting state by fiddling with NVRAM or PRAM settings as root. I'm not familiar with them off the top of my head, though.

Re: Show HN: A fork of sudo with Touch ID support

#35

Post by minitech »

droopyEyelids wrote: post #11

You two are both doing the "ATM machine" thing. (PAM = Pluggable Authentication Module) "Written as a PAM" sure feels wrong on the lips, though.

The original PAM RFC defines PAM as Pluggable Authentication Modules (plural – it’s the name of the framework and not one of its components), so it’s fine and more natural to say “PAM module”.

Re: Show HN: A fork of sudo with Touch ID support

#36

Post by brazzledazzle »

droopyEyelids wrote: post #11

You two are both doing the "ATM machine" thing. (PAM = Pluggable Authentication Module) "Written as a PAM" sure feels wrong on the lips, though.

Heavens to Betsy! You got me. But I do hope someone writes a module for the macos PAM system implementation.

Re: Show HN: A fork of sudo with Touch ID support

#37

Post by minitech »

aplummer wrote: post #16
TekMol wrote: post #14

I never understood the obsession with sudo. Why not just be root in the first place?

You're running code you didn't write or entirely read yourself.

https://xkcd.com/1200/

(Privilege separation is great, but running things as your main account is approximately equal to running them as root.)

Re: Show HN: A fork of sudo with Touch ID support

#38

Post by dvhh »

eshyong wrote: post #12
rrmm wrote: post #4

Shouldn't touch ID be the userid and not the password?

I'm not sure that's true. Anyone can claim to be "rrmm" but only one person has that set of fingerprints.

"at a time", wasn't the movie "demolition man" showed us the physical danger of biometrics (/s)

Re: Show HN: A fork of sudo with Touch ID support

#39

Post by icebraining »

elmigranto wrote: post #22

I don't think this is very useful, at least in my usecase, where most things don't require sudo in the first place (homebrew installed DBs, etc.). Would be awesome to TouchID restart Upstart things on remotes, which is not really feasible. One can dream, though :)

Well, there are ways of doing local auth for remote sudo, like using your ssh-agent[1]. Maybe it could be adapted to ask for TouchID.

[1] http://pamsshagentauth.sourceforge.net/

Post reply on HN