Re: Re: security policy / root passwords

2013-06-11 Thread Tobias Hansen
Am 10.06.2013 11:10, schrieb Josselin Mouette: > What is new is that PackageKit asks for a system update *systematically* > when it finds the system is not up-to-date. I don’t know why, but it > seems to have started with the wheezy release, it did not happen during > the freeze. When I first got

Re: security policy / root passwords

2013-06-11 Thread Chow Loong Jin
On Tue, Jun 11, 2013 at 10:22:32AM +0200, Daniel Pocock wrote: > [...] > I've also seen another laptop that is on the fringe of a wifi coverage > zone getting into a bad state where multiple copies of the wifi password > window appear - if the laptop is unattended for a few hours, you can > come ba

Re: security policy / root passwords

2013-06-11 Thread Daniel Pocock
On 11/06/13 01:11, Michael Banck wrote: > Hi Daniel, > > On Mon, Jun 10, 2013 at 09:24:39PM +0200, Daniel Pocock wrote: >> Every copy of jessie could be distributed with one of the red hoods >> referred to in this article: >> >> http://www.guardian.co.uk/world/2013/jun/09/edward-snowden-nsa-whistle

Re: security policy / root passwords

2013-06-11 Thread Daniel Pocock
On 11/06/13 00:37, Jens Roder wrote: > Hello, > > just like to add that today this "feature" with the popup blocked my gnome > within the suspend procedure, which I did not see but got a hot running > laptop in the bag. When I opened the laptop again I saw the problem and when > clicking on canc

Re: security policy / root passwords

2013-06-10 Thread Michael Biebl
Am 10.06.2013 11:10, schrieb Josselin Mouette: > I consider it a bug, and one that we should aim to fix in the first > wheezy point release. nod. that said, the first point release is basically done, so this will have to wait for 7.2 -- Why is it that all of the instruments seeking intelligent

Re: security policy / root passwords

2013-06-10 Thread Michael Banck
Hi Daniel, On Mon, Jun 10, 2013 at 09:24:39PM +0200, Daniel Pocock wrote: > Every copy of jessie could be distributed with one of the red hoods > referred to in this article: > > http://www.guardian.co.uk/world/2013/jun/09/edward-snowden-nsa-whistleblower-surveillance > > I presume it has some k

Re: security policy / root passwords

2013-06-10 Thread Robert Holtzman
On Mon, Jun 10, 2013 at 08:04:27AM +0800, Chow Loong Jin wrote: > On Sun, Jun 09, 2013 at 01:06:40PM -0700, Robert Holtzman wrote: > > [...] > > In my gross stupidity this seems like a nonissue. How does a popup > > asking for your root p/w differ from using the CLI, typing "su" and > > being asked

Re: security policy / root passwords

2013-06-10 Thread Jens Roder
Hello, just like to add that today this "feature" with the popup blocked my gnome within the suspend procedure, which I did not see but got a hot running laptop in the bag. When I opened the laptop again I saw the problem and when clicking on cancel, the laptop finally when to suspend. I thin

Re: security policy / root passwords

2013-06-10 Thread Daniel Pocock
On 10/06/13 16:51, Simon McVittie wrote: > On 10/06/13 15:36, Timo Juhani Lindfors wrote: >> Simon McVittie writes: >>> * ability to use system-modal prompting or a secure input path >>> (partially done by PK under GNOME Shell, likely to get better >>> under Wayland, not supporte

Re: security policy / root passwords

2013-06-10 Thread Simon McVittie
On 10/06/13 15:36, Timo Juhani Lindfors wrote: > Simon McVittie writes: >> * ability to use system-modal prompting or a secure input path >> (partially done by PK under GNOME Shell, likely to get better >> under Wayland, not supported by sudo or su) > > Not relevant to the current

Re: security policy / root passwords

2013-06-10 Thread Timo Juhani Lindfors
Simon McVittie writes: > * ability to use system-modal prompting or a secure input path > (partially done by PK under GNOME Shell, likely to get better > under Wayland, not supported by sudo or su) Not relevant to the current discussion but this got me curious: can the input path

Re: security policy / root passwords

2013-06-10 Thread Ian Jackson
Simon McVittie writes ("Re: security policy / root passwords"): > * splitting privileged actions into an unprivileged GUI and a > privileged daemon, rather than running the GUI with privileges > (supported and encouraged by PK, not well-supported by sudo or

Re: security policy / root passwords

2013-06-10 Thread Simon McVittie
On 10/06/13 13:54, Daniel Pocock wrote: > That screenshot appears to be Gnome 3. I log in with Gnome Classic so > maybe I'm experiencing something different. I did say "GNOME Shell". The "fallback" GNOME 3.4 session (which might well be called "Classic" in the UI in wheezy) doesn't use Shell, so

Re: security policy / root passwords

2013-06-10 Thread Uoti Urpala
Daniel Pocock wrote: > It was also demonstrated with Windows 7 that users could be tricked by > web sites that simply dimmed the background of the browser window - so > it is not a perfect solution and I would personally prefer to see users > referred to initiate "su" or "sudo" on their own. Initi

Re: security policy / root passwords

2013-06-10 Thread Daniel Pocock
On 10/06/13 14:12, Simon McVittie wrote: > On 10/06/13 12:34, Daniel Pocock wrote: >> a) a web site displaying a "PolicyKit" popup that resembles the wording >> of the Debian popup > GNOME Shell does mitigate this by using a distinctive UI for > "system-modal dialogs", which makes use of the fact t

Re: security policy / root passwords

2013-06-10 Thread Simon McVittie
On 10/06/13 12:34, Daniel Pocock wrote: > a) a web site displaying a "PolicyKit" popup that resembles the wording > of the Debian popup GNOME Shell does mitigate this by using a distinctive UI for "system-modal dialogs", which makes use of the fact that the Shell is the window compositor in order

Re: security policy / root passwords

2013-06-10 Thread Daniel Pocock
On 10/06/13 10:21, Alexey Serikov wrote: > A few points: > > 1) if your user is part of sudo group, most of the time gnome will ask > for your user's password instead of root's. > 2) Debian is a finite set of software. It provides packages (literally > thousands of them) that are stable, safe and m

Re: security policy / root passwords

2013-06-10 Thread Josselin Mouette
Hi, Le dimanche 09 juin 2013 à 18:45 +0200, Daniel Pocock a écrit : > There have been multiple complaints about the new Gnome popup asking for > the root password > > I opened a bug for discussion about the issue, but it was closed by > another DD (not the maintainer) - [1]. Other users have co

Re: security policy / root passwords

2013-06-10 Thread Alexey Serikov
A few points: 1) if your user is part of sudo group, most of the time gnome will ask for your user's password instead of root's. 2) Debian is a finite set of software. It provides packages (literally thousands of them) that are stable, safe and malicious pop-ups free. It also provides packages ena

Re: security policy / root passwords

2013-06-10 Thread Timo Juhani Lindfors
Michael Banck writes: >> I think the best approach would be sudo and requesting the user for >> their own password - and probably be more informative about why the >> password is needed or what is being installed. > > By the way, this seems to be the case for my wheezy installation, > however, I a

Re: security policy / root passwords

2013-06-10 Thread Michael Banck
On Sun, Jun 09, 2013 at 07:20:16PM +0200, Michael Banck wrote: > > Is there any policy within Debian about such matters, particularly for > > packages that are a default part of the distribution? Is it too late to > > remove this popup from wheezy? > > I think the best approach would be sudo and

Re: security policy / root passwords

2013-06-09 Thread Helmut Grohne
On Sun, Jun 09, 2013 at 07:41:34PM +0200, Daniel Pocock wrote: > My feeling is that the user should be told "go and run sudo or su in a > terminal window you opened manually" > > Otherwise, they can't be sure they are putting their password in a > genuine Debian popup. Please explain your threat

Re: security policy / root passwords

2013-06-09 Thread Chow Loong Jin
On Sun, Jun 09, 2013 at 01:06:40PM -0700, Robert Holtzman wrote: > [...] > In my gross stupidity this seems like a nonissue. How does a popup > asking for your root p/w differ from using the CLI, typing "su" and > being asked for the root p/w? I'm assuming that the popup was in > connection with a

Re: security policy / root passwords

2013-06-09 Thread Robert Holtzman
On Sun, Jun 09, 2013 at 07:20:16PM +0200, Michael Banck wrote: > On Sun, Jun 09, 2013 at 06:45:18PM +0200, Daniel Pocock wrote: > > There have been multiple complaints about the new Gnome popup asking > > for the root password > > I am not sure what you are complaining about - that you need to spe

Re: security policy / root passwords

2013-06-09 Thread Timo Juhani Lindfors
Daniel Pocock writes: > My feeling is that the user should be told "go and run sudo or su in a > terminal window you opened manually" I don't think terminal emulation is really a good solution here but your idea does have some merits. Maybe you can make your own policykit agent that asks for the

Re: security policy / root passwords

2013-06-09 Thread Daniel Pocock
On 09/06/13 19:20, Michael Banck wrote: > On Sun, Jun 09, 2013 at 06:45:18PM +0200, Daniel Pocock wrote: >> There have been multiple complaints about the new Gnome popup asking >> for the root password > > I am not sure what you are complaining about - that you need to specify > the root password

Re: security policy / root passwords

2013-06-09 Thread Michael Banck
On Sun, Jun 09, 2013 at 06:45:18PM +0200, Daniel Pocock wrote: > There have been multiple complaints about the new Gnome popup asking > for the root password I am not sure what you are complaining about - that you need to specify the root password to install packages, or that gnome requests additi

security policy / root passwords

2013-06-09 Thread Daniel Pocock
Hi, There have been multiple complaints about the new Gnome popup asking for the root password I opened a bug for discussion about the issue, but it was closed by another DD (not the maintainer) - [1]. Other users have come across the bug too and requested attention for it with the same conce