Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

Post reply on HN
Print view View original

211–220 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#211

Post by Blikkentrekker »

zadler wrote: post #164
datenwolf wrote: post #144

Earlier quoted context omitted.

It's not an X11 design flaw. The very concept of locking the screen is flawed. A flaw that also haunts Wayland, BTW. The concept of screen lockers is having a special layer, that can't be bypassed, which a locker creates. The whole security then hinges on the locker not crashing. X11 does have such a layer. Wayland compositors also implement it through such a layer. And for either the situation is, that if the locker…

It’s amazing to me that The most popular display managers on Linux have this flaw. Perhaps there is a workaround involving switching to another tty?

Perhaps outside of display servers altogether, implementing an authentication system that keeps track of what user currently owns what v.t., and allowing only that user, or root, to switch to that v.t..

Re: Kids find a security flaw in Linux Mint by mashing keys

#213

Post by Liskni_si »

throwanem wrote: post #142
erhan24 wrote: post #135

Earlier quoted context omitted.

Xscreensaver has crashed twice in my life and opened the desktop. That's still a good statistic but it may have crashed because of the animation.

Savers can crash without the screen unlocking. Are you sure it was xscreensaver you were running, and not one of the innumerable incompetent knockoffs?

I've also seen some xscreensaver crashes a while ago: https://news.ycombinator.com/item?id=21224179

Re: Kids find a security flaw in Linux Mint by mashing keys

#214

Post by inetknght »

Blikkentrekker wrote: post #205
inetknght wrote: post #194

Earlier quoted context omitted.

I actually had this happen around Christmas (using Manjaro). I had no idea what the message really meant or what caused it. The instructions were at least clear enough to get back into the running session, which is far better than, say, most of GNOME's crap.

Our internal research found that clear error messages confused our users, so we removed it. I have no idea what KDE is or does, sorry.

> Our internal research found that clear error messages confused our users and removed it.

I can't tell if this is sarcasm or if you're serious. If you're serious, please tell me what product you've butchered so I can avoid it like the plague.

Clear error messages only confuse people who shouldn't be using the product in the first place. More importantly: a clear error message at the cost of a few confused users is far more important than an unclear error message that costs even more users hours or days of trouble.

I would far rather have a message that tells me that the software broke because the desktop manager found a crash loop and point me to the crash loop logs even if some other poor unfortunate soul has no idea what a crash log is or can't figure out how to access or understand the crash log.

Re: Kids find a security flaw in Linux Mint by mashing keys

#215

Post by surajrmal »

datenwolf wrote: post #144
astrange wrote: post #10

Earlier quoted context omitted.

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

It's not an X11 design flaw. The very concept of locking the screen is flawed. A flaw that also haunts Wayland, BTW. The concept of screen lockers is having a special layer, that can't be bypassed, which a locker creates. The whole security then hinges on the locker not crashing. X11 does have such a layer. Wayland compositors also implement it through such a layer. And for either the situation is, that if the locker…

I'm curious what other OS which avoid X11/Wayland do, such as Android. Do they implement an architecture like what you mention?

Re: Kids find a security flaw in Linux Mint by mashing keys

#216

Post by avree »

GlitchMr wrote: post #201
dr_cypher wrote: post #196

Earlier quoted context omitted.

jwz has a lot to say about complex graphical toolkits/desktop environments and their complex locking mechanisms. It's an interesting series of posts. If you are not running xscreensaver on Linux, then it is safe to assume that your screen does not lock. Once is happenstance. Twice is coincidence. Three times is enemy action. Four times is Official GNOME Policy. https://www.jwz.org/xscreensaver/toolkits.html

I would recommend not linking to jwz's website. Use web archive or something if you have to. jwz dislikes Hacker News and intentionally shows an NSFW image when Referer header shows Hacker News.

It's quite nice of Apple to strip this by default in Safari—didn't even realize it was a thing until I switched over to Chrome to see what you were talking about.

Re: Kids find a security flaw in Linux Mint by mashing keys

#217

Post by AnIdiotOnTheNet »

globular-toast wrote: post #166
AnIdiotOnTheNet wrote: post #115

Earlier quoted context omitted.

> I've seen Windows do that too. Really? I have never seen this in Windows. Don't get me wrong, I've seen plenty of lock screen failures in Windows, usually in the form of it suddenly being unresponsive, just never anything that actually gave me access to the locked session again. The closest I've seen is when using RDP, if the Window has been minimized or hidden or otherwise has had reason not to update its display,…

Yes, really. I don't use Windows myself, but I've seen it happen to others. As another commenter said, it's usually when the computer is coming out of "sleep" or something like that. Plenty of times I've seen a glimpse of the desktop that was long enough for me to get a vague idea of what they were doing before the lock screen takes over. If one was determined enough a photograph could easily be taken in that time.

Huh, interesting. Probably explains why I haven't ever seen it: I never use sleep.

Re: Kids find a security flaw in Linux Mint by mashing keys

#218

Post by [deleted] »

smnrchrds wrote: post #204
dr_cypher wrote: post #196

Earlier quoted context omitted.

jwz has a lot to say about complex graphical toolkits/desktop environments and their complex locking mechanisms. It's an interesting series of posts. If you are not running xscreensaver on Linux, then it is safe to assume that your screen does not lock. Once is happenstance. Twice is coincidence. Three times is enemy action. Four times is Official GNOME Policy. https://www.jwz.org/xscreensaver/toolkits.html

Never directly link to jwz from HN. https://web.archive.org/web/20210117212403/https://www.jwz.o...

[deleted]

Re: Kids find a security flaw in Linux Mint by mashing keys

#219

Post by charlesdaniels »

dr_cypher wrote: post #196
GlitchMr wrote: post #183

I find interesting that GNOME Screensaver's security depends on it to not crash. Meanwhile, in KDE the lock screen is managed by KDE Session Management Server which ensures that lock screen cannot be bypassed by simply crashing its process. The way it works is follows: ksmserver draws a black rectangle over everything and spawns kscreenlocker. If kscreenlocker crashes, the black rectangle is still here, and ksmserver…

jwz has a lot to say about complex graphical toolkits/desktop environments and their complex locking mechanisms. It's an interesting series of posts. If you are not running xscreensaver on Linux, then it is safe to assume that your screen does not lock. Once is happenstance. Twice is coincidence. Three times is enemy action. Four times is Official GNOME Policy. https://www.jwz.org/xscreensaver/toolkits.html

Anecdotally, I use xidle[0] and xlock[1], and have found both to be very reliable. xidle supports locking the screen by sending it SIGUSR1, which is really useful since you can trigger it from a process that doesn't have DISPLAY set.

The trick on laptops is to block on sending the signal in the script you use to suspend, so that when the laptop resumes the display is already locked.

0 - https://github.com/steinex/xidle-linux

1 - http://sillycycle.com/xlockmore.html

Re: Kids find a security flaw in Linux Mint by mashing keys

#220

Post by [deleted] »

gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

[deleted]
Post reply on HN