Subject: Re: bug#44808: Default to allowing password authentication on leaves users vulnerable

From: Mark H Weaver <[email-masked]>
Date: Mon, 07 Dec 2020 17:57:45 -0500

Hi,

"Dr. Arne Babenhauserheide" <[email-masked]> writes:
> To nudge them to secure their system, guix system reconfigure could emit
> a warning that this is a potential security risk that requires setting
> an explicit value (password yes or no) to silence.

I think this is a good idea.  Likewise, in the Guix installer, I would
favor asking the user whether or not to enable password authentication,
after warning them that it is a security risk.

I agree with Chris that password authentication is a significant
security risk, but I also worry that if we simply disable it, it will
catch some users by surprise and they may be quite unhappy about it.

     Regards,
       Mark