Linux

There needs to be some mechanism to recover your machine should this happen. It's not that much more difficult to do it on a windows machine either.

The truth of the matter is is if somebody has physical access to your machine it's not your machine anymore. They can pull out the hard drive and plug it into a machine that they have a password for and read from it if it's not encrypted. So on and so forth.

This is why encryption is important, but physical access to a device will always lead to bad things.

If an attacker has physical access then you're already screwed in most cases.

New to Linux so I’m sorry if I’m being ignorant, but it does seem crazy you can get access to a machine without the password.

This is always the case, no matter what OS you use, unless you use full-disk encryption. User credentials are all just data on a disk, so if someone has physical access to your machine, and your disk isn't encrypted, then they can access (and change) those credentials or any other data.

See also: https://ostechnix.com/reset-windows-password-with-linux-live-cd/

What’s even the point of having a password

As you say, preventing remote access is one, but also a password will slow someone down a bit, and stop low-knowledge adversaries entirely, possibly. Also you will at least know someone has messed with your machine if they change the password.

Really, though, there's nothing malicious someone can do to an unencrypted computer by changing the password that they couldn't do without changing the password (copy all your files, delete all your files, install malicious software). Except I guess annoying you by making you change your password back. 😆

Linux can do it to Windows machines too. If it’s not encrypted, USB drive is all it takes.

If it’s not encrypted, a live usb can read all the data on any machine anyway.

I believe it's better not to pretend that an OS password is a secure protection of your data when physically access can just mean - I don't like that OS, I'm going to put on this OS instead, or indeed, I don't like this PC, I'm going to put your data in this PC instead.

Remember, most PCs can become someone else's PC just by plugging in the right USB key. In fact most Linux users will know that, having literally done this themselves.

Yes, there are other ways of doing it as well, you can plug in a live iso and chroot into your proper root and change it for example. This is why you can put a password on GRUB and on your BIOS, even if both of them have passwords, someone can remove your disk plug it into another machine and access your data. Long story short if someone has physical access to your machine is essentially game over. And BTW this is also true for Windows, physical access to the machine has always been considered game over because the person can simply remove the disk and plug it in another system, so any software solution is useless.

This is why encryption is important, if your disk is encrypted putting it in another machine gives garbage unless you know the encryption key, making root rw (as in the link) is useless because you still need to decrypt the disk to access it, plugging a live iso is pointless because unless you know the encryption key you won't be able to chroot into the system. But for most people the fact that no one untrustworthy will ever be physically near your computer is enough to not warrant extra measures of security, not to mention that most people don't have data that could be problematic if leaked (e.g. source code for a large company) and those who do have their drives fully encrypted.

Account passwords have never had the purpose of protecting data from physical access - on Linux or any other operating system that I’m aware of. Physical access means an attacker can pull your drive and plug it into their computer, and no operating system can do anything to block access in that scenario, because the os on disk is not running.

You need disk encryption to protect your data. The trade off is that if you forget the encryption password, your data is unrecoverable by you. But that’s what password managers are for (or just writing it down and putting it in a safe).

Just as easy or easier on Windows since it has a GUI. If someone has physical access to your machine your basically screwed. Unless encrypted they could just pop the drive out and put it in another machine also. Also what is more likely for the average user someone comes in and tries to hack your password physically or something gets into your machine and someone tries remotely.

I quess if you really want to secure your device you shloud use encryption to encrypt your data and/or make something that wipes all your data in case someone tries to log into your device but that's only when you have something really important to hide.

Unix was originally a networked system that many terminals would connect to. Being able to actually reach the machine meant that you had authority.

It's the same today. If someone has physical access, the system is so screwed that you can just give total privileges anyways.

If somebody had physical access to a machine, they can get into it. If you want your data secured l, use encryption as others have suggested.

I don't think "substitute user" is the original meaning, and it's more like a retroactively applied acronym.

Looking at various old Unix manpages, it said various things in the past. In the HP-UX documentation it even lists three different variants in the same man page: "switch user", "set user" and "superuser".

"superuser" is probably the original meaning, because that's what it says in the Unix Manual 1st edition (1971): http://man.cat-v.org/unix-1st/1/su

NAME	su -- become privileged user
SYNOPSIS	su password
DESCRIPTION	su allows one to become the super--user, who has all sortsof marvelous powers. In order for su to do its magic, the user must pass as an argument a password. If the passwordis correct, su will execute the shell with the UID set to that of the super--user. To restore normal UID privileges,type an end--of--file to the super--user shell

I love Unix archeology :)

You can do su to change the user in the current shell. Afaik it just defaults to root if no user ist specified. Everytime you run su you actually do su root

That said I always thought that it stands for switch user so intereresting to know that it‘s substitute.

I've heard people call it superuser since before Linux (AIX Unix a long time ago for example).

But substitute user makes sense since you can su to any user (just root is the default).

Also setting up a periodic snapshot with tools like timeshift can save your life

KVM/Qemu with Virt-Manager as GUI. There's also Virtualbox, but it's Oracle

Not OP, just an admirer, but:

1. If you have the cheese for a WaterRower, it’s quiet enough that you can haul ass in your studio apartment for 90 minutes without bothering your neighbors
2. Rowing burns a fabulous amount of calories with the smallest possible footprint - you take up a rectangle of space for the entirety of your workout and at the end you’re still exhausted
3. Full-body workout baby
4. Naturally builds a functional-looking body, not too grotesque, very 3D
5. As long as you keep it clean, no one will notice you’re not using your rowing machine - it’s pretty obvious when you’re not using the 32 kg kettlebell in the corner
6. There are cool apps out there for rowing machines, but without the prohibitive expense of Peloton

Oh man you should get a rowing machine, I got one for Christmas and have used it for like 180 days so far and let me tell you Im getting absolutely shredded. My beer belly has turned into shoulder and chest and bicep muscle and is now totally gone. My torso is like an inverted triangle, my lats are poppin, i got like dimples in my shoulders now above my armpit, shit's wild.

The key is doing it like every day and turning up the resistance if it gets easy. Also stretch a lot and look up what you're doing so you don't hurt yourself

I'm not intersted in rowing machines

Okay well they'll still be there when you decide you wanna get jacked