Mark H Weaver writes: > Hi, > > "Dr. Arne Babenhauserheide" <[email protected]> writes: >> To nudge them to secure their system, guix system reconfigure could emit >> a warning that this is a potential security risk that requires setting >> an explicit value (password yes or no) to silence. > > I think this is a good idea. Likewise, in the Guix installer, I would > favor asking the user whether or not to enable password authentication, > after warning them that it is a security risk. > > I agree with Chris that password authentication is a significant > security risk, but I also worry that if we simply disable it, it will > catch some users by surprise and they may be quite unhappy about it. > > Regards, > Mark
It's clear that quite a few people are unhappy with switching the default, fearing lockout. I'm fine with making the above compromise given all that, personally.
