News for hackers. Stuff that matters.
Re:The security hole in sudo by TazeTSchnitzel on Wednesday May 23, 2012 @11:27AM (#4013517)
Windows hasn't been "administrator by default" since Vista.
Re:The security hole in sudo by gnaritas on Wednesday May 23, 2012 @11:45AM (#4013611)
It's still administrator by default, they just prompt you to click ok on every administrative action, something users still do blindly.
Re:The security hole in sudo by TazeTSchnitzel on Wednesday May 23, 2012 @11:51AM (#4013636)
And Ubuntu users don't blindly enter their passwords at gksudo prompts?
Re:The security hole in sudo by gnaritas on Wednesday May 23, 2012 @03:11PM (#4014773)
Huge difference between hitting OK and typing the admin password.
Re:The security hole in sudo by TazeTSchnitzel on Wednesday May 23, 2012 @05:08PM (#4015310)
Really? Both are pretty instinctive to me, I do them with little thought. I even switch capslock on and off mid-password without thinking about it to type a capitalised portion.
Re:The security hole in sudo by gnaritas on Wednesday May 23, 2012 @11:15PM (#4016594)
Yes really. Anyone can hit ok, but not anyone knows the admin password. Someone can't walk up to your machine while you're away and install software in Linux, they can in windows. Hitting Ok is not sufficient. The point of sudo is to verify your identity, an ok prompt does not do that.
Re:The security hole in sudo by tallanvor on Wednesday May 23, 2012 @02:08PM (#4014411)
No, it's not administrator by default. The first user created is an administrator, but that user normally runs in a standard user security context. The prompt provides a temporary elevation to administrator level by use of an administrative security token associated with the account. The prompt also runs in a separate desktop to prevent malicious code from interfering with it.

If you try creating a new user through the control panel, you'll notice that the default selection is to create a standard user.

Re:The security hole in sudo by gnaritas on Wednesday May 23, 2012 @03:11PM (#4014766)
> The prompt provides a temporary elevation to administrator level by use of an administrative security token associated with the account.

Rather what I said. A borked version of sudo.