I want to make Linux my main OS. I’ve used Windows for decades. Since Vista or 7, the Windows security model is this, from what I understand:
- unprivileged programs have limited/no ability to do scary things to your computer. they might be able to read some data, but it’s not going to implant malware in the boot sequence for Windows.
- if a program wants escalation, it triggers a UAC popup and the user has to accept it. Remote programs cannot accept UAC on a physical person’s behalf. Escalated programs have admin level control and can do the scary things.
- As with any OS, there may be privilege escalation vulnerabilities that escalate (1) into (2).
I’ve only had Windows malware a few times since Win7, and the entry point was fairly avoidable. (Running a sketchy EXE, and a possible drive-by malware install via an advertisement. I could never prove the latter.)
I have never run a password on my Windows machines.
On any system, physical access is game over.
On Linux, the password is paramount. I’ve tried to understand the security model and I keep failing. Synthesizing from arch wiki
SSH
Equivalent to local physical access as the user. If it’s a sudoers or root account, it can do scary things. Not a threat if ssh is disabled or well secured (password or key pairs).
If a network has a well configured firewall (on the router), it should block ssh requests from outside the network unless the admin specifically wants SSH outside the network.
As with any OS, there may be bugs that allow remote access outside of SSH.
Local login / password prompts to physical users
Without a password, you can’t escalate to root and install new software. Some software, often dealing with hardware (smartctl) requires sudo/root to run.
Encrypted drives
Passwords can decrypt drives if they are encrypted.
Keyrings
Some DEs (KDE) offer a ‘keyring’ that stores passwords. It’s locked/encrypted with a password, usually the same as the login password.
So what am I missing? Is Windows + UAC + no password secure? What is Linux protecting us from by using passwords?
I think part of what you’re missing may be a set of very old assumptions about where the danger is coming from.
Linux was modeled after UNIX, and much of its core software was ported from other UNIX versions, or at least written in imitation of their utilities. UNIX was designed to be installed on large pre-Internet multi-user mainframe+dumb terminal systems in industry or post-secondary education. So there’s an underlying assumption that a system is likely to have multiple human users, most of whom are not involved in maintaining the system, some of whom may be hostile to each other or to the owner of the system (think student pranks or disgruntled employees), and they all log in at once. Under those circumstances, users need to be protected from each other, and the system needs to be protected from malicious users. That’s where the system of user and root passwords is coming from: it’s trying to deal with an internal threat model, although separating some software into its own accounts also allows the system to be deployed against external threats. Over the years, other things have been layered on top of the base model, but if you scratch the paint off, you’ll find it there underneath.
Windows, on the other hand, was built for PCs, and more or less assumes that only one user can be logged in to a machine at a time. Windows security is concerned almost entirely with external threats: viruses and other malware, remote access, etc. User-versus-user situations are a very minor concern. It’s also a much more recent creation—Windows had essentially no security until the Internet had become well-established and Microsoft’s poor early choices about macros and scripts came back to bite them on the buttocks.
So it isn’t so much that one is more secure than the other as that they started with different threat models and come from different periods of computing history.
This is the correct answer.