From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1IImwO-00005T-NW for mharc-grub-devel@gnu.org; Wed, 08 Aug 2007 10:55:16 -0400 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1IImwN-00004t-3T for grub-devel@gnu.org; Wed, 08 Aug 2007 10:55:15 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1IImwL-0008Vd-Ab for grub-devel@gnu.org; Wed, 08 Aug 2007 10:55:14 -0400 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1IImwK-0008VX-Vj for grub-devel@gnu.org; Wed, 08 Aug 2007 10:55:13 -0400 Received: from smtp-vbr14.xs4all.nl ([194.109.24.34]) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1IImwK-0000VK-FU for grub-devel@gnu.org; Wed, 08 Aug 2007 10:55:12 -0400 Received: from localhost.localdomain (249-174.surfsnel.dsl.internl.net [145.99.174.249]) by smtp-vbr14.xs4all.nl (8.13.8/8.13.8) with ESMTP id l78Et8dw056411 for ; Wed, 8 Aug 2007 16:55:09 +0200 (CEST) (envelope-from mgerards@xs4all.nl) From: Marco Gerards To: The development of GRUB 2 References: <46B6193D.4010403@gmail.com> <877io7fyag.fsf@xs4all.nl> <20070807124550.GA30639@nubol.oskuro.net> Mail-Copies-To: mgerards@xs4all.nl Date: Wed, 08 Aug 2007 16:57:20 +0200 In-Reply-To: <20070807124550.GA30639@nubol.oskuro.net> (Jordi Mallach's message of "Tue, 7 Aug 2007 14:45:50 +0200") Message-ID: <874pja9ir3.fsf@xs4all.nl> User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.4 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Virus-Scanned: by XS4ALL Virus Scanner X-Detected-Kernel: FreeBSD 4.6-4.9 Subject: Re: [PATCH] password command implementation X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2007 14:55:15 -0000 Jordi Mallach writes: > On Tue, Aug 07, 2007 at 02:17:16PM +0200, Julien Ranc wrote: >> - plain text passwords are indeed very insecure, but I kept them, as it was >> possible in Grub legacy. Should I remove them ? > > I think there's plenty of people who will have use for plain, insecure > passwords. > > The first security problem of having access to the grub menu is that in > a lot of cases, it is equal to having access to the hardware. That blows > up pretty much all of your security measures, if you're not using > encrypted filesystems or whatever. > > Plain password is easy to beat, but at least it adds a minimal layer of > "annoyance" for anyone wanting to boot what they aren't supposed to > boot. So you want to make it possible to have plain text passwords because it is easier to hack? :-) -- Marco