The auto login feature when Whonix-Host boots up may be a good feature. But please consider reverting back to default changeme password or provide an option to set a password when calamares installer is running when installing to Hard drive or USB. I installed veracrypt and when I ran it. It broke the mounting/unmounting capability from the GUI because by default the user account doesn’t have a password which complicates things for newbies. To unmount we have to use the terminal. Can the login screen be displayed when the screen locks itself due to inactivity? Also giving passwordless sudo access to applications is more dangerous regardless of whether malware can access the password through an exploit. Passwordless access can provide simple malware the capability to gain root access and affect the system without finding an exploit.
Godzilla via Kicksecure Forums:
The auto login feature when Whonix-Host boots up may be a good feature.
Off-topic.
This is not a Whonix support forum.
I installed veracrypt and when I ran it. It broke the mounting/unmounting capability from the GUI because by default the user account doesn’t have a password which complicates things for newbies.
This a bug that you would need to report to veracrypt.
Can the login screen be displayed when the screen locks itself due to inactivity?
You can use a Screen
Lock.
Also giving passwordless sudo access to applications is more dangerous regardless of whether malware can access the password through an exploit. Passwordless access can provide simple malware the capability to gain root access and affect the system without finding an exploit.
An exploit is not even required.
These are general issues. These issues are unspecific to
Kicksecure. Most if not all
Freedom Software Linux desktop distributions are affected by one or
multiple of these issues. This is elaborated here:
Or another way to look at this: There are already multiple decades old
exploits available and it’s trivial to use these.
All of this is elaborated on this wiki page:
The main thing is to fix the user’s password in live mode, please (sorry, I wrote about this before, but this is only serious problem with live-mode). But I like his idea of creating a password when installing on host. The lack of a password is unusual, and someone can be scary.