Kids find a security flaw in Linux Mint by mashing keys • Hacker News Board

Re: Kids find a security flaw in Linux Mint by mashing keys

#61

Post by withinboredom » Wed, Jan 20, 2021, 10:01 AM UTC

_puk wrote: post #37

martin-adams wrote: post #6

This reminds me of when I was about 14. I had a Tamagotchi which I had for a record amount of time. My niece, about 2 at the time wanted to see it so let her hold it. Within 1/2 a second, she squeezed both buttons at the same time and crashed it. My daughter managed to buy 24 hours of football pass with NowTV by pressing the same button repeatedly on the remote within about 5 seconds. So a crash like this doesn't sur…

Hah, just reminded me.. My daughter, whilst roaming in the US from the EU somehow managed to get unlimited data after her initial miserly roaming allowance was used up.. simply by switching airplane mode on and off repeatedly until data worked. I was stressing getting back home to a huge bill, but kept the "all chargeable services have been stopped" messages just in case. My final bill was £300+, zeroed. Phew!

Also reminds me of “impossible” bug reports, only to discover the way to reproduce them was just simply double clicking on links and buttons.

Re: Kids find a security flaw in Linux Mint by mashing keys

#62

Post by 12312311241231 » Wed, Jan 20, 2021, 10:03 AM UTC

Keep in mind that screensavers aren't the only untested dumpster fire on Linux Desktops (or ~ distributions in general).

The whole desktop architecture is out of date. I wouldn't be surprised if someone argued that screensavers aren't important because it's just your user data exposed, the root account is still safe!

Re: Kids find a security flaw in Linux Mint by mashing keys

#63

Post by canofbars » Wed, Jan 20, 2021, 10:03 AM UTC

krick wrote: post #44

pojntfx wrote: post #40

Earlier quoted context omitted.

X11 problem. Wayland fixes that and is the default on Fedora etc. as of 2021.

Oh, so Wayland is finally ready to replace X11?

Whether wayland is ready for you basically comes down to 2 questions:

* Do you use a nvidia GPU * Do you need to screen share from electron or other x11 only applications (MS teams, etc)

Its ready if you said no to both of those.

Re: Kids find a security flaw in Linux Mint by mashing keys

#64

Post by tauntz » Wed, Jan 20, 2021, 10:04 AM UTC

Mi kid got around the lock screen of my mac. Twice.

It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months. After that I took my phone, sat him behind my computer and started to record him playing with the buttons but it never happened again and my hopes of getting a bug bounty from Apple vanished :(

Re: Kids find a security flaw in Linux Mint by mashing keys

#65

Post by bionade24 » Wed, Jan 20, 2021, 10:04 AM UTC

j-james wrote: post #45

astrange wrote: post #10

Earlier quoted context omitted.

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

I'm surprised he doesn't mention XSecureLock. Its entire focus is on preventing issues like this with modularity and redundancy. https://github.com/google/xsecurelock

I fear it's as secure as vsftpd: Secure until a large amount of users use it and find bugs.

Re: Kids find a security flaw in Linux Mint by mashing keys

#66

Post by josefx » Wed, Jan 20, 2021, 10:08 AM UTC

toast0 wrote: post #58

astrange wrote: post #10

Earlier quoted context omitted.

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

The underlying design issues are: a) there's no Xserver concept of a lock screen which would be hard to fix, I suspect. How would you signal X to lock/unlock; what would it do if the lock client wasn't connected, etc. b) there's no atomic way to transfer mouse/keyboard grab to another window, which means you can't have a reliable, crash reduced screen locker that supervises a beautiful password checking program; it h…

> and yes, you'd have to deal with fragmentation,

Why not just require that it is there? Is there even a valid reason for someone to keep the extension out unless it is to give another "this is the reason X sucks" speech?

Re: Kids find a security flaw in Linux Mint by mashing keys

#67

Post by tremon » Wed, Jan 20, 2021, 10:11 AM UTC

josephg wrote: post #35

gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

Can anyone explain why a crash in xscreensaver results in the computer being unlocked? It seems like this whole class of bugs could be fixed pretty easily by having a simple process watchdog run xscreensaver as a child process, and re-launch it if it crashes without first signalling that the desktop has been unlocked.

I don't believe the X system had/has a separate protocol for screen locking, or if it does, that any of the programs implement it. So xscreensaver is just another X client that happens to draw itself full-screen on top of all other apps and grab all user input.

From the point of view of the display manager, a screensaver/screenlocker crashing is just a simple app crash. There's nothing in the protocol to suggest that this is a security failure.

Re: Kids find a security flaw in Linux Mint by mashing keys

#68

Post by Kelamir » Wed, Jan 20, 2021, 10:13 AM UTC

gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

I use i3lock, no such issues with it.

Re: Kids find a security flaw in Linux Mint by mashing keys

#69

Post by bionade24 » Wed, Jan 20, 2021, 10:13 AM UTC

canofbars wrote: post #63

krick wrote: post #44

Earlier quoted context omitted.

Oh, so Wayland is finally ready to replace X11?

Whether wayland is ready for you basically comes down to 2 questions: * Do you use a nvidia GPU * Do you need to screen share from electron or other x11 only applications (MS teams, etc) Its ready if you said no to both of those.

You can use MS teams in Chromium or Firefox. The secret is that Browsers disable 3rd Party cookies per default for a year now or so and Microsoft has not reacted to it yet.

Re: Kids find a security flaw in Linux Mint by mashing keys

#70

Post by toast0 » Wed, Jan 20, 2021, 10:14 AM UTC

josefx wrote: post #66

toast0 wrote: post #58

Earlier quoted context omitted.

The underlying design issues are: a) there's no Xserver concept of a lock screen which would be hard to fix, I suspect. How would you signal X to lock/unlock; what would it do if the lock client wasn't connected, etc. b) there's no atomic way to transfer mouse/keyboard grab to another window, which means you can't have a reliable, crash reduced screen locker that supervises a beautiful password checking program; it h…

> and yes, you'd have to deal with fragmentation, Why not just require that it is there? Is there even a valid reason for someone to keep the extension out unless it is to give another "this is the reason X sucks" speech?

Because, IIRC, xscreensaver is launched on demand (idle timer, power management), and that's a terrible time to detect the extension and tell a user that they won't be able to resume their session, because their Xserver is too old.

Also, because of piecemeal releases, and remote X. You might update Xscreensaver, but not your X server or desktop environment. You might have a dedicated X terminal which can't easily have its server component updated, but you run remote sessions that have an updated Xscreensaver. (Btw, if you do this, you're pretty dedicated in 2021)