Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

🥺: the best sudo replacement

xeiaso.net

Post reply on HN
Print view View original

491–500 of 559 posts

Re: 🥺: the best sudo replacement

#491

Post by account-5 »

wkat4242 wrote: post #472
account-5 wrote: post #451

Earlier quoted context omitted.

You have 20 servers at home? What's you electrical bill like?

Last month's electricity bill was about 75€ including electric heating, VAT and fixed charges. I do get 2 hours free per day during which I run the heading full blast at the moment, and other high energy stuff. Most of my servers are not always on, some are in the cloud and some are virtual. The ones that run 24/7 are NUCs which have excellent idle energy usage. The bigger ones are HP microservers but like I said tho…

> Last month's electricity bill was about 75€ including electric heating, VAT and fixed charges.

Damn, I'm double+ that a month with turning everything off at the plug each night and during the day when not on. Just one of the benefits of living in post-brexit UK, with a lame useless gov... Anyway nevermind. Always wanted to do the home assistant thing with one of my rpi, but can't afford it just now.

Re: 🥺: the best sudo replacement

#492

Post by bypiney »

Dylan16807 wrote: post #289
doodlesdev wrote: post #277

Earlier quoted context omitted.

[flagged]

Consider it like dressing up, with nice clothes. Sexual attraction is an important aspect of dressing up to some people, but that's only part of the time, and just generically being dressed up is not a sex thing.

[flagged]

Re: 🥺: the best sudo replacement

#493

Post by xg15 »

varajelle wrote: post #445
yjftsjthsd-h wrote: post #409

Earlier quoted context omitted.

Sarcasm/humor; the program in question does no authentication, so it's not an alternative in any meaningful sense.

I was thinking the same. But then I thought about it more and wondered why you need to enter your own password if you're already logged on. If an attacker is already in the system, it can install key logger and whatnot without the root password. And the xn--ts9h program can have the Unix permission so that only the user can run it.

There is the mental function signalling "hang on, you're about to do something unsafe. Are you sure you want to do this?"

But I think there are some scenarios where it serves a practical security purpose as well:

- You're in an office, went away to grab a coffee and left the screen unlocked (bad!). Without sudo, a malicious person could indeed quickly install a backdoor or keylogger and take over your system.

- you're executing a third-party script on your user account. Without a password prompt, that script could trivially escalate its privileges by embedding sudo commands. With a password prompt, you'll hopefully stop and ask yourself why the script is asking for your password.

Basically, you actually cannot assuming that every running on a user account is really authorised by that user. So asking for the password is an attempt to reaffirm that it's really the user who gave that command.

> If an attacker is already in the system, it can install key logger and whatnot without the root password.

Yes, but that would require the attacker to, well, run sudo...

Re: 🥺: the best sudo replacement

#495

Post by BrandoElFollito »

doublepg23 wrote: post #298
azalemeth wrote: post #168

Earlier quoted context omitted.

The are quite a lot of "gotchas" with passwords being Unicode though. One of my favourite tricks is to include a null byte in passwords and see what happens. Sudo treats it as the end of the string. Passwd gives "token manipulation error" and nopes out. Many websites seem to fail in interesting ways...

I've run into a service where having a password longer than 15 characters _truncates_ it but the password change dialog does not so it's stuck in limbo.

This is still the case with PeopleSoft (32 chars limitation, and truncation)

Re: 🥺: the best sudo replacement

#496

Post by BrandoElFollito »

sshine wrote: post #437
xahrepap wrote: post #386

Earlier quoted context omitted.

The PayPal forgot password form had this bug just a couple years ago. I changed my password to a generated one. And it was too long. But it didn’t tell me. Just silently truncated. I used the password reset to change it. This time I used a pretty short password I could type (to rule out a weird copy-paste bug or something). Logged in, went to the change password option and THAT page informed me there was a character…

Password character limits are important. They reveal that the back-end service probably doesn't hash the passwords, which is a good time to GTFO.

My bank requires a password of exactly 8 digits. In 2023.

Re: 🥺: the best sudo replacement

#497

Post by BrandoElFollito »

Xylakant wrote: post #452
sshine wrote: post #437

Earlier quoted context omitted.

Password character limits are important. They reveal that the back-end service probably doesn't hash the passwords, which is a good time to GTFO.

I would consider setting a (high) limit for a password a good practice. No one wants an attacker to run a megabyte of password data through your slow password hash. It should be a limit that normal users never reach, but something like 100 chars seems entirely reasonable.

The typical password managers allow you to generate up to ~120 characters, I would go for 500 just to be on the safe side.

Re: 🥺: the best sudo replacement

#498

Post by intuxikated »

Xylakant wrote: post #452
sshine wrote: post #437

Earlier quoted context omitted.

Password character limits are important. They reveal that the back-end service probably doesn't hash the passwords, which is a good time to GTFO.

I would consider setting a (high) limit for a password a good practice. No one wants an attacker to run a megabyte of password data through your slow password hash. It should be a limit that normal users never reach, but something like 100 chars seems entirely reasonable.

Some web frameworks have such limits built-in. Django for example has a limit of 4096 characters for password input, which should be more than enough for anyone, including people using long random-generated passwords from password managers

Re: 🥺: the best sudo replacement

#499

Post by distantsounds »

CGamesPlay wrote: post #406

What was the point of this post? No, this program isn't a replacement for sudo; it's closer to a reimplementation of su. The post links to 3 CVEs and talks about Rust, but only one of the CVEs was a memory safety bug, the others are a logic error and a race condition, neither of which are protected by Rust (sadly).

[flagged]
Post reply on HN