Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wayland Keylogger

github.com

Post reply on HN
Print view View original

51–60 of 121 posts

Re: Wayland Keylogger

#51

Post by Blikkentrekker »

erik_seaberg wrote: post #49
Blikkentrekker wrote: post #37

Earlier quoted context omitted.

Yes, in both cases it is not not for technical reasons. Many Wayland compositors simply lack support for nVidia cards as they use a different protocol than all the others, and many graphics acceleration calls are simply not implemented through nested servers.

What I’m getting at is that Wayland has better hardware acceleration only of compositing. It doesn’t seem to have any support for rendering shapes into pixels, even though that’s mostly why hardware accelerators were invented.

As far as I know, there is no technical reason why Wayland would have better hardware acceleration.

Modern X11 compositors work on very similar principles. — the only difference is the Wayland protocol requires that there be such a compositor, and on X11 one is free to even use outdated server drawing calls that have not been used for decades.

Re: Wayland Keylogger

#52

Post by zlynx »

Jkvngt wrote: post #47
theamk wrote: post #44

Earlier quoted context omitted.

Ugh, they cannot fix it because this is not something that wayland can fix at all. Look, if you have user access to the account, you can get its data. Even if you somehow make Wayland 100% secure, you can still replace “firefox” shortcut with malicious version which also steals all your passwords. No windowing aystem involved at all.

But bleargh, why do Wayland proponents always seem to bring up keyloggers? That’s icky.

The X11 protocol allows any client connected to the server to become a keylogger or insert input events. So, even a X11 client trapped in a sandbox or another user account has full access.

Re: Wayland Keylogger

#53

Post by theamk »

Jkvngt wrote: post #47
theamk wrote: post #44

Earlier quoted context omitted.

Ugh, they cannot fix it because this is not something that wayland can fix at all. Look, if you have user access to the account, you can get its data. Even if you somehow make Wayland 100% secure, you can still replace “firefox” shortcut with malicious version which also steals all your passwords. No windowing aystem involved at all.

But bleargh, why do Wayland proponents always seem to bring up keyloggers? That’s icky.

Do you mean "opponents"? For example, this post is the only post on HN about wayland keyloggers, and it is clearly written by Wayland opponents.

Re: Wayland Keylogger

#54

Post by theamk »

Blikkentrekker wrote: post #34
Kaze404 wrote: post #18

Earlier quoted context omitted.

I would love to see a real permission system on Linux, where applications have to explicitly ask me before accessing things deemed important. It's never been a problem for me, but it would give me some comfort.

It would be both annoying and somewhat useless, for giving an application access to the input system gives an application access to everything because then it could give itself access to everything. The same of course applies to giving it access to the file system. Something so simple as an audio manipulation application must have access to the filesystem, unless one only will it to be able to save within a specific…

> giving an application access to the input system gives an application access to everything

How do you figure? There are systems already (like Wayland) where default access to input only gives you input when the app is active, and entire different process is required for global hotkeys or key logging.

There are no nice GUIs to manage that AFAIK, but this is not an impossible problem to solve anymore.

> The same of course applies to giving it access to the file system.

uh, what? no. giving a browser access only to "~/Downloads" will work great and will make it much more secure.

The modern Linux is much more than capabilities and user-based permissions. A mount namespace with selectively bind-mounted dirs can do wonders for security. And things like "bindfs" which can translate UIDs on the fly can give even more isolation.

Re: Wayland Keylogger

#55

Post by dralley »

Jkvngt wrote: post #47
theamk wrote: post #44

Earlier quoted context omitted.

Ugh, they cannot fix it because this is not something that wayland can fix at all. Look, if you have user access to the account, you can get its data. Even if you somehow make Wayland 100% secure, you can still replace “firefox” shortcut with malicious version which also steals all your passwords. No windowing aystem involved at all.

But bleargh, why do Wayland proponents always seem to bring up keyloggers? That’s icky.

Because the X11 protocol itself enables every X app to keylog every other app without any "hacks" involved, which is what this is.

It's the difference between having a poor quality lock on your door and having no door at all.

Re: Wayland Keylogger

#57

Post by sprash »

the_duke wrote: post #5

I do use Linux (almost) exclusively, but I'm well aware of the security limitations. Forget this keylogger. All you need is to somehow write a single line into .profile or .bashrc, which basically every executed program can do, and you own the user account. You can intercept every program with wrappers by changing PATH or adding desktop entries in .local/share/applications, extract all data from applications, use LD_…

> I do believe that the path forward has to be Mac OS/Android/iOS style sandboxing

No this would be exactly the wrong path. One of the major strengths of FOSS/Linux is the fact that there are multiple authorities checking the code for bugs and security issues. You usually have at least three stages: contributor -> release manager -> package maintainer. On some distribution you even have a dedicated security team. And on top of that, since it is FOSS you have full synergy across the whole ecosystem. Which means e.g. if the Debian security team finds a bug the Arch team can correct the problem within hours.

FOSS needs to play it's strengths and the fact that the general case is running trusted software whereas the exception is running untrusted software is one of those major strengths. Which means additional complexity and user annoyances stemming from overarching access control measures only apply selectively to a small set of programs.

Re: Wayland Keylogger

#58

Post by arghwhat »

The position of the Wayland project is that security isolation requires sandboxing. Otherwise, applications can do whatever you can do, including changing all your personal config files and scripts.

The security considerations in Wayland are primarily aimed at not being a weak link undermining sandboxing efforts, which is the case with X11.

Without sandboxing, writing to e.g. ~/.profile would in most cases be enough for a malicious application to take over the machine. Equivalents apply to all platforms.

Re: Wayland Keylogger

#59

Post by Blikkentrekker »

theamk wrote: post #54
Blikkentrekker wrote: post #34

Earlier quoted context omitted.

It would be both annoying and somewhat useless, for giving an application access to the input system gives an application access to everything because then it could give itself access to everything. The same of course applies to giving it access to the file system. Something so simple as an audio manipulation application must have access to the filesystem, unless one only will it to be able to save within a specific…

> giving an application access to the input system gives an application access to everything How do you figure? There are systems already (like Wayland) where default access to input only gives you input when the app is active, and entire different process is required for global hotkeys or key logging. There are no nice GUIs to manage that AFAIK, but this is not an impossible problem to solve anymore. > The same of c…

> How do you figure? There are systems already (like Wayland) where default access to input only gives you input when the app is active, and entire different process is required for global hotkeys or key logging.

That's not what is commonly understood as access to the input system.

> There are no nice GUIs to manage that AFAIK, but this is not an impossible problem to solve anymore.

So long you be willing to live with a walled garden environment where one's text editor either can't edit the files on one's system any more, or is given sufficient permissions to circumvent all of this regardless.

> uh, what? no. giving a browser access only to "~/Downloads" will work great and will make it much more secure.

It would also mean that no modern browser works any more since they need access to far more to even start up.

You should `strace` a browser and be surprised that it constantly needs to read and write files from all over the system.

I would also be rather annoyed with a browser that can only save files in one folder rather than wherever it please me.

Finally, even if this browser only have access to `~/Downloads`, it would still be capable of modifying any file that something else put there, thus allowing it to easily install malware into anything that anything els downloads, without the user's knowledge.

> The modern Linux is much more than capabilities and user-based permissions. A mount namespace with selectively bind-mounted dirs can do wonders for security. And things like "bindfs" which can translate UIDs on the fly can give even more isolation.

There is a good reason that SELinux never truly penetrated: — it is capable of much of this, but it would also make most applications unworkable and users would complain about no longer being able to do as they will.

More or less what the situation is on Android, or Windows.

Re: Wayland Keylogger

#60

Post by zokier »

Jkvngt wrote: post #12
the_duke wrote: post #5

I do use Linux (almost) exclusively, but I'm well aware of the security limitations. Forget this keylogger. All you need is to somehow write a single line into .profile or .bashrc, which basically every executed program can do, and you own the user account. You can intercept every program with wrappers by changing PATH or adding desktop entries in .local/share/applications, extract all data from applications, use LD_…

Forget it? It’s the main selling point of Wayland that keyloggers are impossible.

The main selling point of Wayland is the simplification of graphics pipeline

> "The wayland tag line is "every frame is perfect", by which I mean that applications will be able to control the rendering enough that we'll never see tearing, lag, redrawing or flicker" -- Kristian Høgsberg, creator of Wayland [1]

Input handling and related issues are mere afterthought in comparison.

Besides that, this project is not really keylogging Wayland in any meaningful way. Wayland compositor sends the key events to the application and its the applications responsibility from there on to do whatever it pleases; in this case it printing them to stderr but that is incidental. Wayland can't just magically protect you from having malicious code running within your application.

edit: a strained analogy, but this thing is akin to saying that "you can eavesdrop https" and then show ld_preload hooks for intercepting openssl calls.

[1] https://www.phoronix.com/scan.php?page=article&item=xorg_way...

Post reply on HN