whonix default password (changeme) impact

[jerry]

What are security impact of not changing whonix default password ?
Is this is only matters when attacker gets inside my whonix vms and wants to privilege escalate ?
In other words whonix passwords only effect “local security”, not security from remote perspective ? There is no “login panel” where attacker can login to my whonix over internet ?

After i installed whonix i was using it with default password for few hours. Should i be worry that in that time attacker got in my system with default password ?

[Patrick]

@jerry

There is no “login panel” where attacker can login to my whonix over internet ?

This part is for sure: Such as thing certainly does not exist. On the contrary, allowing Remote Administration - Whonix isn’t trivial and doesn’t happen by accident.

@jerry

After i installed whonix i was using it with default password for few hours. Should i be worry that in that time attacker got in my system with default password ?

No, that’s not how attacks work.

---

• Online Password Cracking Restrictions

@jerry

In other words whonix passwords only effect “local security”, not security from remote perspective ?

Unless remote administration is setup with password based authentication, it indeed should be affected local security only, not remote security.

@jerry

What are security impact of not changing whonix default password ?

Big write-up here, Conclusion chapter updated just now:

Strong Linux User Account Isolation