https://bugs.kde.org/show_bug.cgi?id=179678
--- Comment #87 from Bo Weaver <b...@boweaver.com> --- (In reply to Nate Graham from comment #86) > I understand that you're frustrated. I'm frustrated too. If you have the > appropriate technical skills, you could help to review > https://phabricator.kde.org/D21795 and https://phabricator.kde.org/D21783? > That's the path forward here. I did look over the links. I didn't see any discussion on locking root out of logins or why this should be done. I admit I'm not a coder I'm a security guy. I don't write applications or systems I break into them. Last year I pointed out many reasons that actions like this do nothing to secure the system. Again this does nothing to secure the system only break the DE. Again CTL ATL F1 defeats your patch and will give you a root login. Think about it hacks are normally done remotely through a system level service or process. A DE isn't the point of entry. Crippling the DE does nothing to keep an attacker out. Even a local hack doesn't secure the system if an account is compromised with sudo access so locking the root login does not to secure the system. Really you all are spending time and resources to fix a problem that doesn't exist. Really if you want to do something to really secure your DE then remove the bubbleheads on the login screen with the user names and photos and blank all the login fields. Really this IS a security problem. As I said before on with local access to the machine you have given me half the problem of brute forcing an account, the user name. Even more so with the photo. Let's say John has an account on a machine I could "guess" his user name is john but what if his user name is "frogger" I could brute force john unitl the end of time and get no where. If I walk my his machine and see his photo then I know his login is frogger so now I know what user name to brute force. Nate you said "That's the path forward here." do I need to login in there to fight this battle? PLEASE!!!! could I have my desktop back! -- You are receiving this mail because: You are watching all bug changes.
