For example, someone creates a fake Authenticate dialog to get my root password. How to know if it is real or fake?
So you're [probably] looking at a PolicyKit escalation prompt there. Anybody without one of those who wants to play along can just run run
How can we check it's really PolicyKit, not some custom-made phishing window?
Well you can get information about a Window with
So as far as we can tell (note that I'm a KDE user) this is a legitimate prompt. It's not running off some local script so as long as something evil hasn't already rooted the system (but hey, why would they need our password again?), we're probably safe.
How can we tell what it's going to do?
In the case of
In the case of PolicyKit, you can click that details tab and you'll see which permission it wants to execute. In KDE you'll also see the caller PID which can be looked up (
You can hover over the action and get the PolicyKit policy it wants to execute. In Ubuntu the policy is shown by default. These policies can be looked up. The one above comes from
But don't blindly trust PolicyKit!
PolicyKit has these rules and services so select actions can be performed as root without having to run the entire process like that. You need to be vigilant though. Obviously if you're running
It might be nothing but investigate before you stick your password in. After is too late.
And even if it's all legit, who's to say you don't have a keylogger stealing all your passwords anyway? Or something overriding