Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

81–90 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#81
post #2

Well, the original definition of the word "hacking". Hacking on keyboard to exploit keypress timings, key combinations and key buffer overflows.

A well known reference, Eric Raymond's "jargon file" a.k.a. "hacker's dictionary" offers 9 definitions, much broader and seemingly older than keypress timings: http://catb.org/~esr/jargon/html/H/hack.html

( see also http://catb.org/~esr/jargon/html/index.html and https://en.wikipedia.org/wiki/Jargon_File )

Re: Kids find a security flaw in Linux Mint by mashing keys

#82
post #71

Earlier quoted context omitted.

I've seen Windows do that too. It's not just Linux. My guess is that these lock screens are all bolted on afterwards rather than being in the design from the ground up.

Windows 10 or some ancient version of Windows?

There had been recent bugs on windows 10 where you could navigate your way to a desktop session through the input assistance dialogs (mashing the shift button). They fixed it by removing one of the links in the UI. In older Windows I think it was a mix of help and printer dialogs.

Re: Kids find a security flaw in Linux Mint by mashing keys

#83
post #64

Mi kid got around the lock screen of my mac. Twice. It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months.…

Perhaps it was related to this bug: https://www.wired.com/story/macos-high-sierra-hack-root/

Re: Kids find a security flaw in Linux Mint by mashing keys

#84

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

This happens to me regularly with macOS too, so perhaps it's harder then you imagine.

Re: Kids find a security flaw in Linux Mint by mashing keys

#86

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

This happens to me regularly with macOS too, so perhaps it's harder then you imagine.

Never happened to me on Windows, so it shouldn't be that hard.

Re: Kids find a security flaw in Linux Mint by mashing keys

#87
post #73

Earlier quoted context omitted.

Its not that they still had python 2, its that the binary "python" referred to python 2 on ubuntu (it might even still be like this) while other distros had it pointed to python 3.

Given that python versions are incompatible by design you should probably explicitly refer to the version your code supports. At least that is my takeaway from this mess.

This whole situation is a bad trap for novices, given how many tutorials, class slides, etc ask students to copy/paste various invocations of pip and python that may or may not work verbatim on their distro.

Re: Kids find a security flaw in Linux Mint by mashing keys

#88
post #64

Mi kid got around the lock screen of my mac. Twice. It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months.…

Probably just hit enter when the password field was empty. For some reason that bypassed all security on OS X.

Re: Kids find a security flaw in Linux Mint by mashing keys

#89
post #64

Mi kid got around the lock screen of my mac. Twice. It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months.…

My kid (3 years old then) found an issue in the MacOS lock screen as well. It didn't result in a bypass, but a "Spinning Beach Ball of Death". I could then reproduce it and even filed an issue, but only I could reproduce (and one funny response was: "Why would you want a screen shot of the screen sleeping? It would just be black." - well tell that to my kid): https://discussions.apple.com/thread/7598463

Re: Kids find a security flaw in Linux Mint by mashing keys

#90
post #67
post #35

Earlier quoted context omitted.

Can anyone explain why a crash in xscreensaver results in the computer being unlocked? It seems like this whole class of bugs could be fixed pretty easily by having a simple process watchdog run xscreensaver as a child process, and re-launch it if it crashes without first signalling that the desktop has been unlocked.

I don't believe the X system had/has a separate protocol for screen locking, or if it does, that any of the programs implement it. So xscreensaver is just another X client that happens to draw itself full-screen on top of all other apps and grab all user input. From the point of view of the display manager, a screensaver/screenlocker crashing is just a simple app crash. There's nothing in the protocol to suggest that…

xscreensaver + light-locker should be okay, there is no virtual keyboard.

There is also xsecurelock [1] by Google.

[1] https://github.com/google/xsecurelock

Post reply on HN