Hacker News Reader

Comment by teach | Hacker News Reader

At work I'm required to use a locked-down Windows 7 machine, which has antivirus software I can't disable. (I would disable it if I could.)

At home I use Linux and do not use antivirus software.

I also always log in as root. I like to live dangerously. :)

View on HN

> I also always log in as root. I like to live dangerously. :)

Man... I cannot even begin to express how bad this is.

Especially if there are drive-by attacks.

Running as a privileged user protects other users and the OS, not you. If code runs as you, it has access to your data, your cookies, your cache, etc.

Protecting the OS does protect you: stealing my data/cookies today is different than installing OS level backdoor / keylogger and stealing my bank password, tax prep, etc next month/year/etc.

So, installing a backdoor / keylogger in user level isn't that bad? why?

If they've stolen your cookies, they can already login as you. The keylogger is already going to run in user space, as you.

You don't need to compromise root/a privileged user in order to get the keys to the kingdom. Once I've compromised whatever user your browser environment runs as, mission accomplished.

its really not a big deal to type sudo when installing stuff.

Also if you have any hope of dealing with servers in the wider world, you want to shake that habit pronto (and learn ssh keys).

Also your ironically complaining you can't disable your anti-virus software, but the fact is you have a sloppy approach to security that your IT department is protecting everyone in the company from.

I only stay logged in as root on my personal server. For more public servers I of course disable password logins, ssh in using a key file, etc.

(I wonder what about my post makes you think you should talk down to me and make (incorrect) assumptions about my approach to security?)

If you read about the technical implementation of the AV software that's been analyzed, you might not think it's that dangerous after all:

http://www.cso.com.au/article/441070/google_security_researc...

> I also always log in as root. I like to live dangerously. :)

Noob mistake. Never log in as root. Isn't sudo enough for you?

Why on earth would I "never log in as root"? And I'm pretty sure it's not a "noob mistake" if I've been using Unix since 1994.

Because then any malware that gets installed by you (or a program you run, like, say, your browser) has root privileges. If you were not logged in as root, anything running as you would not have root privileges and therefore would have much less power to ruin your computer.

It's not a controversial statement. It's security 101. Hell, even Windows Vista implemented the same strategy once Microsoft realized logging in with admin rights was a bad idea.

I'm logged in as root to a headless server that doesn't even run a GUI. I pretty much only install software from the Ubuntu repository. The server is only used by me.

I think it's okay if I log in as root if I want.

Reply on news.ycombinator.com