Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

Post reply on HN
Print view View original

151–160 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#151

Post by sontek »

metafunctor wrote: post #126
sontek wrote: post #121

Earlier quoted context omitted.

JWZ has been complaining about these screensavers for a decade. His screensaver from 20 years ago still doesn't have these issues. Its not an X11 problem. - https://bit.ly/3o2qekz - https://bit.ly/38Y6pGO (using bit.ly because he gives a testicle if referrer is HN :P)

I don't understand the part about JWZ's testicles, so here are the links without bit.ly tracking for those whose ad blockers don't allow them: - https://www.jwz.org/blog/2021/01/i-told-you-so-2021-edition/ - https://www.jwz.org/xscreensaver/toolkits.html [Edit]: I understand now. My browser doesn't send referrer URLs, and I think that's the real fix instead of using something like bit.ly!

haha, yeah. I don't like using URL shorteners either there is just a balance to be made between them tracking you and getting redirected to testicles.

Can't count on everyone having referrer turned off

Re: Kids find a security flaw in Linux Mint by mashing keys

#152

Post by YtvwlD »

f1refly wrote: post #30
gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

For x lockscreens this is solved by making sure the lock launches _before_ the system is suspended, I'm not sure how many distros do it like that though.

This is the default on any modern distro (which has logind).

Re: Kids find a security flaw in Linux Mint by mashing keys

#153

Post by sontek »

erhan24 wrote: post #135
sontek wrote: post #121

Earlier quoted context omitted.

JWZ has been complaining about these screensavers for a decade. His screensaver from 20 years ago still doesn't have these issues. Its not an X11 problem. - https://bit.ly/3o2qekz - https://bit.ly/38Y6pGO (using bit.ly because he gives a testicle if referrer is HN :P)

Xscreensaver has crashed twice in my life and opened the desktop. That's still a good statistic but it may have crashed because of the animation.

Sounds like you were probably using gnome-screensaver or some of the many other poorly written alternatives like cinnamon that do this. I don't believe there is any way for xscreensaver to unlock the desktop even if it does crash

Re: Kids find a security flaw in Linux Mint by mashing keys

#154

Post by fullstop »

ascar wrote: post #133
gambiting wrote: post #128

Earlier quoted context omitted.

You still get the testicles if you click this link, at least using Chrome you do. It's because the referrer field is set to HN so they know where the traffic is coming from.

Time to switch to Firefox and give Google less data. Firefox doesn't seem to send the referrer :)

Brave does not send the referrer as well.

Re: Kids find a security flaw in Linux Mint by mashing keys

#155

Post by shawnz »

sontek wrote: post #121
astrange wrote: post #10

Earlier quoted context omitted.

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

JWZ has been complaining about these screensavers for a decade. His screensaver from 20 years ago still doesn't have these issues. Its not an X11 problem. - https://bit.ly/3o2qekz - https://bit.ly/38Y6pGO (using bit.ly because he gives a testicle if referrer is HN :P)

In fact jwz himself says in that very post that it is a fundamental problem with X11:

> X11 ... was designed with no security to speak of, and so lockers have to run as normal, unprivileged, user-level applications. ... This mistake of the X11 architecture can never, ever be fixed.

He also claims in the second post that Xscreensaver is actually vulnerable to exactly the same kind of attack:

> The xscreensaver daemon is a critical piece of security software. The reason for this is that, as a screen locker, any bug in the program that causes it to crash will cause the screen to unlock. As soon as xscreensaver is no longer running, the screen is no longer locked. Therefore, great care must be taken to ensure that the daemon never crash.

Re: Kids find a security flaw in Linux Mint by mashing keys

#156

Post by BoorishBears »

mikeyjk wrote: post #80
josefx wrote: post #60

Earlier quoted context omitted.

That might be a kde limitation in general. The amount of "fun" I had dealing with two screens on kde is outright endless. Not sure they even test that kind of configuration, 640x480 pixels should be enough for everyone.

I'm using 3 monitors on KDE with Debian currently and it's been fine for me. All screens lock together etc.

I'm sure they're referring to the failsafe.

Re: Kids find a security flaw in Linux Mint by mashing keys

#157

Post by buckminster »

josephg wrote: post #77
tremon wrote: post #67

Earlier quoted context omitted.

I don't believe the X system had/has a separate protocol for screen locking, or if it does, that any of the programs implement it. So xscreensaver is just another X client that happens to draw itself full-screen on top of all other apps and grab all user input. From the point of view of the display manager, a screensaver/screenlocker crashing is just a simple app crash. There's nothing in the protocol to suggest that…

You don't need special X support for having a lightweight process monitor. I'm imagining 2 processes: 1. Process monitor shows a fullscreen black window. Launches xscreensaver --lock or something as a child process 2. Xscreensaver shows the lock screen over the top of the process monitor, with a password prompt When the correct password is entered, xscreensaver signals to its parent process. Then both processes close…

jwz wrote a document explaining why this is hard. (Note that this link may result in an unsavoury redirect if you click on it from here. You can, e.g. copy and paste it to avoid this.)

https://www.jwz.org/xscreensaver/toolkits.html

Re: Kids find a security flaw in Linux Mint by mashing keys

#158

Post by mensetmanusman »

Hilarious, esp. if you have kids.

I see similar behavior with smartphones.

3 y.o. figure it out better than my parents because it seems their mindset is ‘do all the things’ to see what the i/o structure is. Their brain is built that way when they are so young.

Re: Kids find a security flaw in Linux Mint by mashing keys

#159

Post by BruiseLee »

mightybyte wrote: post #143

Years ago I taught a high school typing class in a K-12 school. The school didn't have the funds to get a commercial typing program so I wrote my own typing program. It evolved over time with features to help me track the students' progress etc. One day we had a school open house where all the parents could come to school. We had a bunch of different activities set up in different classrooms and I ended up getting as…

Are you sure it was a segfault? DOS did not have any memory protection, so segfault would be impossible. Or maybe you used some protected mode DOS extender?

Re: Kids find a security flaw in Linux Mint by mashing keys

#160

Post by GrumpyNl »

thomasmg wrote: post #89
tauntz wrote: post #64

Mi kid got around the lock screen of my mac. Twice. It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months.…

My kid (3 years old then) found an issue in the MacOS lock screen as well. It didn't result in a bypass, but a "Spinning Beach Ball of Death". I could then reproduce it and even filed an issue, but only I could reproduce (and one funny response was: "Why would you want a screen shot of the screen sleeping? It would just be black." - well tell that to my kid): https://discussions.apple.com/thread/7598463

That discussion railed of pretty quickly.
Post reply on HN