Suppose I set my password to something very simple, like the letter 'a', such that anything with access to a login prompt effectively has root access. What attacks does this open me up to, as a desktop Linux user?

closed as too broad by jasonwryan, muru, thrig, Kiwy, roaima Mar 2 '18 at 8:48

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You better ask on info sec than here, also this question is opinion base. – Kiwy Mar 2 '18 at 8:21
  • Kfoa, if my answer was most helpful please accept it. If it wasn't please don't accept it. – user9303970 Mar 3 '18 at 6:15

It's safe from remote attacks unless you spin up a service that utilizes password authentication. For instance, it would still be safe to allow SSH access to that account with the simple password if password authentication were disabled and keys were used instead.

In other words, it's not a problem if it's a home computer in a safe environment.


It will be very easy to detect (or not very easy since it's so non-intuitive) your password in a Brute Force Attack.

Then, assuming the intruder succeeded finding your password, it could destroy your system by a simple command like:

sudo rm -rf /*

This command will delete 99% of your system and will make totally unfunctional and also unrecoverable from itself, usually.

  • r argument means recursive (work with current inode and all derivatives).
  • f means force (ignore nonexistent inodes and don't prompt about them).
  • The /* means "everything under the root directory in your inode system".

You might want to check man rm for more data on the rm deletion command.

Sidenote: Always make scheduled backups (manual or automatic).