Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

Post reply on HN
Print view View original

71–80 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#71

Post by Jonnax »

globular-toast wrote: post #16
gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

I've seen Windows do that too. It's not just Linux. My guess is that these lock screens are all bolted on afterwards rather than being in the design from the ground up.

Windows 10 or some ancient version of Windows?

Re: Kids find a security flaw in Linux Mint by mashing keys

#72

Post by josephg »

josefx wrote: post #48
josephg wrote: post #35

Earlier quoted context omitted.

Can anyone explain why a crash in xscreensaver results in the computer being unlocked? It seems like this whole class of bugs could be fixed pretty easily by having a simple process watchdog run xscreensaver as a child process, and re-launch it if it crashes without first signalling that the desktop has been unlocked.

> and re-launch it if it crashes without first signalling that the desktop has been unlocked. Might be better to just exit the session or load a minimalistic replacement lock program (like the original xscreensaver) to avoid an infinite crash loop.

Maybe! An infinite crash loop is also usually better than a security vulnerability, so I think it would be a win even without that.

Also this bug (and probably most other bugs xscreensaver has had over the years) wouldn't result in an infinite crash loop anyway.

Re: Kids find a security flaw in Linux Mint by mashing keys

#73

Post by josefx »

canofbars wrote: post #59
josefx wrote: post #55

Earlier quoted context omitted.

Other commenters link to similar issues with Wayland screen lockers. So I am not sure how the current shiny fixes things. > python 2 In contrast to Wayland that can be installed in parallel to python 3. So the only reason to remove it is if you enjoy breaking working software.

Its not that they still had python 2, its that the binary "python" referred to python 2 on ubuntu (it might even still be like this) while other distros had it pointed to python 3.

Given that python versions are incompatible by design you should probably explicitly refer to the version your code supports. At least that is my takeaway from this mess.

Re: Kids find a security flaw in Linux Mint by mashing keys

#74

Post by jorvi »

herpderperator wrote: post #13

In middle school long ago, I was using one of the library search computers. They ran Windows XP and were locked down to the point where you couldn't open anything except the software that was running and you had no access to the desktop. One day I was rapidly mashing the "Search" button in the native book-searching software they were using - for no reason at all - and it suddenly opened an Explorer window out of nowh…

This reminds me of the classic XP login screen bypass by opening the help dialog, then the print dialog, then searching for a file to open for printing, and then executing 'explorer.exe' (I might be misremembering, this is quite a while ago).

I also remember figuring out how to share my USB key as a network drive to other users. Many fun middays were had blasting around in Halo or Soldier of Fortune II with like 10 friends, although less fun was had when our school's sysadmin found some lingering cache files that were owned by my id.

Re: Kids find a security flaw in Linux Mint by mashing keys

#75

Post by saagarjha »

kowlo wrote: post #56
ohgodplsno wrote: post #46

Earlier quoted context omitted.

Make sure your browser sends in the Referer header. Otherwise, this is the image that gets displayed: NSFW. This is a testicle in an egg cup. https://cdn.jwz.org/images/2016/hn.png

Thank you! I'm using plain Safari with no extensions. An interesting website and blog, I like it! I wonder what their problem with HN is, although I don't mind being a testicle!

Safari doesn't do referrers for what I assume is privacy reasons.

Re: Kids find a security flaw in Linux Mint by mashing keys

#76

Post by saagarjha »

globular-toast wrote: post #16
gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

I've seen Windows do that too. It's not just Linux. My guess is that these lock screens are all bolted on afterwards rather than being in the design from the ground up.

I've seen this happen on macOS too.

Re: Kids find a security flaw in Linux Mint by mashing keys

#77

Post by josephg »

tremon wrote: post #67
josephg wrote: post #35

Earlier quoted context omitted.

Can anyone explain why a crash in xscreensaver results in the computer being unlocked? It seems like this whole class of bugs could be fixed pretty easily by having a simple process watchdog run xscreensaver as a child process, and re-launch it if it crashes without first signalling that the desktop has been unlocked.

I don't believe the X system had/has a separate protocol for screen locking, or if it does, that any of the programs implement it. So xscreensaver is just another X client that happens to draw itself full-screen on top of all other apps and grab all user input. From the point of view of the display manager, a screensaver/screenlocker crashing is just a simple app crash. There's nothing in the protocol to suggest that…

You don't need special X support for having a lightweight process monitor.

I'm imagining 2 processes:

1. Process monitor shows a fullscreen black window. Launches xscreensaver --lock or something as a child process

2. Xscreensaver shows the lock screen over the top of the process monitor, with a password prompt

When the correct password is entered, xscreensaver signals to its parent process. Then both processes close gracefully.

If xscreensaver crashes without signalling, the process manager silently restarts xscreensaver.

None of that requires any changes to X. You'd just want to be sure xscreensaver is displayed on top of the process manager's black window.

Re: Kids find a security flaw in Linux Mint by mashing keys

#78

Post by eth0up »

Physlock works comparatively well, but nothing can stop the omniscient stupidity of, eg ctrl-alt-del 10x (or similar) invoking reboot, which I've found no method of preventing. The general attitude encountered when seeking a solution to this madness is "if someone has physical access, you're pwned anyway", which is also supremely unimaginative and omnisciently stupid. This has gnawed at my cranial portions for years, and I now speak forth in due fury.

https://linuxcommandlibrary.com/man/physlock

Re: Kids find a security flaw in Linux Mint by mashing keys

#79

Post by ekimekim »

3np wrote: post #17
gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

slock has never surprised or disappointed me.

I've experienced an issue where the window blacking out the screen would get moved aside, it was something to do with plugging and unplugging monitors and somehow the screen contents would become visible. I probably couldn't reproduce it if I tried.

I wasn't too concerned about it since it still blocked all user input, but if you had sensitive info visible it could definitely be an issue.

Re: Kids find a security flaw in Linux Mint by mashing keys

#80

Post by mikeyjk »

josefx wrote: post #60
bionade24 wrote: post #52

Earlier quoted context omitted.

No, it's not failsafe. I know a person where only one screen of two got locked, the second one remained operational.

That might be a kde limitation in general. The amount of "fun" I had dealing with two screens on kde is outright endless. Not sure they even test that kind of configuration, 640x480 pixels should be enough for everyone.

I'm using 3 monitors on KDE with Debian currently and it's been fine for me.

All screens lock together etc.

Post reply on HN