Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

Post reply on HN
Print view View original

141–150 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#141

Post by notyourday »

astrange wrote: post #10
gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

I do not understand. There's an xl and its PAM-checking derivative xl-more that just work.

They do nothing fancy - paint a window over everything and wait for the password to be typed in. No animation. No graphics. No anything. No enter unlock password dialog. I am sure there could be some edge cases but I'm having a hard time identifying them.

Re: Kids find a security flaw in Linux Mint by mashing keys

#142

Post by throwanem »

erhan24 wrote: post #135
sontek wrote: post #121

Earlier quoted context omitted.

JWZ has been complaining about these screensavers for a decade. His screensaver from 20 years ago still doesn't have these issues. Its not an X11 problem. - https://bit.ly/3o2qekz - https://bit.ly/38Y6pGO (using bit.ly because he gives a testicle if referrer is HN :P)

Xscreensaver has crashed twice in my life and opened the desktop. That's still a good statistic but it may have crashed because of the animation.

Savers can crash without the screen unlocking. Are you sure it was xscreensaver you were running, and not one of the innumerable incompetent knockoffs?

Re: Kids find a security flaw in Linux Mint by mashing keys

#143

Post by mightybyte »

Years ago I taught a high school typing class in a K-12 school. The school didn't have the funds to get a commercial typing program so I wrote my own typing program. It evolved over time with features to help me track the students' progress etc. One day we had a school open house where all the parents could come to school. We had a bunch of different activities set up in different classrooms and I ended up getting assigned to the 3rd grade classroom to set up my typing program so anyone coming through could test their typing speed. It was a DOS program and I didn't want people using anything other than my typing program, so I modified it so you couldn't quit the typing program. Over the course of the day the 3rd graders were hanging out in their homeroom not really doing anything productive. Of course the computer was a novel attraction and they were just smashing keys and exploring my program's UI. Eventually at one point I noticed that they had somehow crashed my program with a segfault in what had otherwise become a pretty stable piece of software. To this day I have absolutely no idea what the bug was.

Re: Kids find a security flaw in Linux Mint by mashing keys

#144

Post by datenwolf »

astrange wrote: post #10
gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

It's not an X11 design flaw. The very concept of locking the screen is flawed. A flaw that also haunts Wayland, BTW.

The concept of screen lockers is having a special layer, that can't be bypassed, which a locker creates. The whole security then hinges on the locker not crashing. X11 does have such a layer. Wayland compositors also implement it through such a layer. And for either the situation is, that if the locker crashes, that layer is destroyed by implication and the session exposed.

That's a flawed concept.

What you really want is detachable graphics session. On the text console one can effortlessly use screen or tmux and to "lock" the session simply detach and exit to the regular login getty.

You want exactly the same, but for X11. And there's no obstacle in printiple to implement this. It's just that the Xorg server can't detach. Almost all of the required code is there, fundamentally it'd be the same code that's executed during a VT switch.

In the meantime one can use Xpra with Xvfb to create detachable X11 sessions, which then however lack GPU acceleration.

Re: Kids find a security flaw in Linux Mint by mashing keys

#145

Post by dd_roger »

thomasmg wrote: post #89
tauntz wrote: post #64

Mi kid got around the lock screen of my mac. Twice. It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months.…

My kid (3 years old then) found an issue in the MacOS lock screen as well. It didn't result in a bypass, but a "Spinning Beach Ball of Death". I could then reproduce it and even filed an issue, but only I could reproduce (and one funny response was: "Why would you want a screen shot of the screen sleeping? It would just be black." - well tell that to my kid): https://discussions.apple.com/thread/7598463

> https://discussions.apple.com/thread/7598463

Wow every new person who joins that thread misses the point more than the previous one. This was painful to read.

Re: Kids find a security flaw in Linux Mint by mashing keys

#146

Post by throwanem »

GekkePrutser wrote: post #127
Tsiklon wrote: post #33

Earlier quoted context omitted.

Judging by the redirect to the image macro of a testicle in an egg cup, specifically calling out HN, I think we can assume the author of that article does not appreciate links to his website from HN

So what. This is how the web works. If you don't want people linking to you, don't have a website. He puts this blog out there for people to read, is it so weird that tech sites like HN would want to link to it? And really if you're being DDoSed by a small thing like HN comment links you really have to up your game :) Wait till you get featured on reddit (previously called slashdotting when slashdot was still a big t…

He doesn't think he's getting DDoSed from here. He doesn't respect anyone who comes from here.

Nor should he, not least because the redirect reliably results in ~90% of comments in any thread where jwz is mentioned being about the testicle in the eggcup rather than anything substantial.

Re: Kids find a security flaw in Linux Mint by mashing keys

#147

Post by SamBam »

Illniyar wrote: post #84
gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

This happens to me regularly with macOS too, so perhaps it's harder then you imagine.

Yup. On my 10.15.7 this happens frequently. Often if I open up the laptop I can see the current contents of the screen for a good 5-8 seconds before the lock screen shows.

I don't think I could interact with the screen in any way, but I could certainly take a picture of it, if I had any private information on the screen.

Re: Kids find a security flaw in Linux Mint by mashing keys

#148

Post by throwanem »

joshspankit wrote: post #124

My own anecdote: My daughter was 1ish at the time, and I sat her down while I grabbed something from the fridge. Windows 98, locked. When I came back the screensaver was on, the password dialog was still up, but the desktop was fully functional in front of it . I could navigate, open applications, and everything else. Still no idea how she did it, but that’s not the first or last time she surprised me :)

I think you just had to hit Escape.

In general, the way you secured a Windows 9x box was by locking the door to the room it was in.

Re: Kids find a security flaw in Linux Mint by mashing keys

#149

Post by joshuaissac »

speedgoose wrote: post #86
Illniyar wrote: post #84

Earlier quoted context omitted.

This happens to me regularly with macOS too, so perhaps it's harder then you imagine.

Never happened to me on Windows, so it shouldn't be that hard.

It happens to me on Windows 10 if I close the laptop lid to lock the desktop and send it to sleep.

When I open it again, the desktop is accessible for a few seconds (sometimes long enough to launch programs) before the lock screen activates and I have to input my password. The workaround I use is to manually lock with Win+L before closing the lid.

Re: Kids find a security flaw in Linux Mint by mashing keys

#150

Post by YtvwlD »

xorcist wrote: post #105
canofbars wrote: post #63

Earlier quoted context omitted.

Whether wayland is ready for you basically comes down to 2 questions: * Do you use a nvidia GPU * Do you need to screen share from electron or other x11 only applications (MS teams, etc) Its ready if you said no to both of those.

> Do you need to screen share from electron or other x11 only applications Doesn't XWayland solve this?

No.
Post reply on HN