3 ms·

This almost sounds like a joke. Walk up to a Linux system using grub from anytime in the last six years, hit the backspace key 28 times and system is pwned. Jus

by yborg 11y ago

This almost sounds like a joke. Walk up to a Linux system using grub from anytime in the last six years, hit the backspace key 28 times and system is pwned. Just ... wow.

ah- 11y ago
There was a similar bug in the Ubuntu lock screen a while algo: https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572 https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572 When the screen is locked with password, if I hold ENTER after some seconds the screen freezes and the lock screen crashes. After that I have the computer fully unlocked.
- draven 11y ago
  Jwz has some strong opinions about screensaver/screenlocker design: https://www.jwz.org/blog/2014/04/the-awful-thing-about-getting-it-right-the-first-time-is-that-nobody-realizes-how-hard-it-was/ https://www.jwz.org/blog/2014/04/the-awful-thing-about-getti... I'd say he's right.
- jmtd 11y ago
  There is a wonderful rich history of screensaver lock snafus, nicely summarized by JWZ here https://www.jwz.org/blog/2014/04/the-awful-thing-about-getting-it-right-the-first-time-is-that-nobody-realizes-how-hard-it-was/ https://www.jwz.org/blog/2014/04/the-awful-thing-about-getti... and the icing on the cake is the humble pie post, where someone found the same in xscreensaver https://www.jwz.org/blog/2015/10/xscreensaver-5-34/ https://www.jwz.org/blog/2015/10/xscreensaver-5-34/
exDM69 11y ago
I don't think using a bootloader password is a very common way of (attempting to) secure a computer. At least I have never used it nor thought it could actually secure my computer (at least without locking out the bios/uefi to allow booting from other media and enabling secure boot). So on any of my PCs, you could just press F10 to get access to the grub rescue shell. I think that bios/uefi passwords and disk encryption are much more commonly used to prevent unauthorized access to an intruder with physical access to the computer when it boots.
justinsaccount 11y ago
More likely "Walk up to a Linux system and find this issue isn't even relevant as a bootloader password is not even configured in the first place"

by yborg 11y ago

This almost sounds like a joke. Walk up to a Linux system using grub from anytime in the last six years, hit the backspace key 28 times and system is pwned. Just ... wow.

ah- 11y ago

There was a similar bug in the Ubuntu lock screen a while algo: https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572 https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572 When the screen is locked with password, if I hold ENTER after some seconds the screen freezes and the lock screen crashes. After that I have the computer fully unlocked.

draven 11y ago
Jwz has some strong opinions about screensaver/screenlocker design: https://www.jwz.org/blog/2014/04/the-awful-thing-about-getting-it-right-the-first-time-is-that-nobody-realizes-how-hard-it-was/ https://www.jwz.org/blog/2014/04/the-awful-thing-about-getti... I'd say he's right.
jmtd 11y ago
There is a wonderful rich history of screensaver lock snafus, nicely summarized by JWZ here https://www.jwz.org/blog/2014/04/the-awful-thing-about-getting-it-right-the-first-time-is-that-nobody-realizes-how-hard-it-was/ https://www.jwz.org/blog/2014/04/the-awful-thing-about-getti... and the icing on the cake is the humble pie post, where someone found the same in xscreensaver https://www.jwz.org/blog/2015/10/xscreensaver-5-34/ https://www.jwz.org/blog/2015/10/xscreensaver-5-34/

exDM69 11y ago

I don't think using a bootloader password is a very common way of (attempting to) secure a computer. At least I have never used it nor thought it could actually secure my computer (at least without locking out the bios/uefi to allow booting from other media and enabling secure boot). So on any of my PCs, you could just press F10 to get access to the grub rescue shell. I think that bios/uefi passwords and disk encryption are much more commonly used to prevent unauthorized access to an intruder with physical access to the computer when it boots.

justinsaccount 11y ago

More likely "Walk up to a Linux system and find this issue isn't even relevant as a bootloader password is not even configured in the first place"