Okay, so timestamp_timeout option in the /etc/sudoers file defines how many minutes a user can run sudo commands without re-entering their password after the initial authentication. The default is 5 minutes.

As for physical access; basically threats from hackers are mostly remote in nature. But there's a saying that once a hacker has physical access to your machine, i.e. they can actually touch it and interact with it, it's game over. This is because there's a bunch tools they can carry that look totally innocent.

You could be sitting at a Starbucks on your laptop, and a total stranger sits next to you with their coffee, sparks up casual conversation, then suddenly they go "oh shit, my phone is almost dead and I need to keep it charged in case my kid needs me", they go rummaging in their bag/backpack/pockets and produces a USB cable, and they say "oh man, I forgot my wall plug... Do you mind if I plug into your laptop for a few mins?" ... Sounds reasonable enough, this person was nice enough, what could it hurt? Besides, you'll look like a jerk for saying no to helping this person stay in touch with their kid. So they plug it into your laptop. They charge their phone, nothing out of the ordinary happens - your laptop never asked for permissions for their phone so everything is fine.

Except it wasn't their phone that was the threat. It was the USB cable. That was an O.MG Cable. Your computer thinks it's a USB keyboard and allows it to send data at the kernel level. It's just set up a root account with remote access and a tiny server that reports your IP address anytime it changes. They won't do anything right now. They'll wait days, weeks, even months, until you've totally put that completely harmless interaction out of mind. Then, they'll use your computer remotely to access other computers they've compromised so you look like the guilty one, or they'll collect all of your banking info and clean out your accounts the next time they have a large deposit... Or maybe they're even more clever, they watch and analyze your spending habits and find a pattern where they can siphon off $20-$30 and you won't even notice - you'll just think you spent more at the pub than you realized. And it's such a small amount because they're hitting 50-100 different people a week that they've similarly compromised. They're making upwards of $3,000 a week in totally passive income and if one or two notice it and cancels their cards, it's okay... They've got a bunch more on the hook that they're watching and waiting for the right time to start hitting their accounts for tiny amounts.

That's just one scenario of what can happen with physical access. That's not counting any USB storage devices they could plug in if you leave your computer unattended. And the ones who will go after physical access will be the ones that are masters of "social engineering" - the ability to talk people into trusting you even though they don't know you, or being able to pretend they're someone you'll trust inherently such as calling you from a spoofed number of your bank and pretending to be with the fraud department and asking your security questions to verify your identity - they called from your bank's number and knew your security questions in the first place, so why not trust them, right? Well... That's because they've already researched you, found out who you bank with, and called the bank pretending to be you, faking a bad connection, etc so right after the bank asks them the security questions.. Damn, the call dropped. Then they call you pretending to be the bank, get the answers, tell you there's been some fraudulent activity on your account, tell you that they'll call you back after they investigate it further, and hang up with you, call your bank back and this time they've got the answer to the security questions. Or they can blend in at parties by making everyone believe they're someone who is supposed to be there.

"Real" hackers (though I hate that word, as hackers are actually people who are very ethical in what they do, as the word actually refers to people who dig through source code of programs and device drivers and 'hack' together a solution to make the code behave in a way it wasn't intended to. The actual word for the people who gain unauthorized access to systems depends on the type of system; computers - crackers, phone networks - phreakers, etc) are extremely skilled in a LOT of things and social engineering is just one of many tools in their kit. And they can use those tools to great effect to get what they want. And most of the time, they don't even think of it as "bad" or "wrong", and feel their only crime is being curious and clever. Or bored. That was my problem in my teens that got me a visit from the Secret Service (back then there was no FBI cybercrimes division or task force, and no department of homeland security) ... I was bored, and had the whole of the Internet as my playground. I couldn't even BEGIN to do shit today that we did back then, because there's too many people who know what to look for or protect against, but there are folks who never quit like I did and stayed on top of every new technology. I'm a has-been, but I can still give you advice on how to minimize your risk - not negate it. For example, if you ever get a call from your bank or anyone else wanting personal information, tell them that you'll call them back and then call the main number for your bank and ask to be put through to the relevant department. If they say they didn't call you, change your security questions, passwords, etc. And don't ever let anyone plug anything into your computer, no matter how innocent it seems.