3 ms·

But why can he vouch that libX11 is any more secure? The library that runs complex input method code on every key-press, that has had CVEs in it? [0] [1] [0] h

by Jasper_ 11y ago

But why can he vouch that libX11 is any more secure? The library that runs complex input method code on every key-press, that has had CVEs in it? [0] [1] [0] https://cgit.freedesktop.org/xorg/lib/libX11/tree/modules/im/ximcp/imCallbk.c https://cgit.freedesktop.org/xorg/lib/libX11/tree/modules/im... [1] https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2004 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-20... Not to mention that I can still write a keylogger that bypasses jwz's xscreensaver. [2] [2] https://github.com/magcius/keylog https://github.com/magcius/keylog

digi_owl 11y ago
Didn't know that screen locks were supposed to defeat keyloggers. I thought they existed to stop people walking up to an unattended computer and mess around. Anyways, if i am reading the CVE right it is about how X11 can be provoked into maxing out its stack. Possibly annoying for those trying to use X11, but not something that leaks data. The more i see "security" discussed on HN, the more i feel that there needs to be a ranking system. All to often it seems like people are operating with a binary definition of security, putting anything with a CVE in the insecure bin.
johnchristopher 11y ago
I believe this blog post http://blog.martin-graesslin.com/blog/2015/01/why-screen-lockers-on-x11-cannot-be-secure/ http://blog.martin-graesslin.com/blog/2015/01/why-screen-loc... is relevant to the conversation and the key logger part (but I am out of my league to comment about it).
notalaser 11y ago
> But why can he vouch that libX11 is any more secure? The library that runs complex input method code on every key-press, that has had CVEs in it? [0] [1] GTK (at least the 2.x series, I don't know if that's changed in 3.x) uses libx11. There's a good chance that, if there's a major flaw in libx11 which can be exploited, a GTK-based program is vulnerable to it. GTK is pretty massive, so it likely introduces issues of its own. E.g. this bug: https://bugzilla.gnome.org/show_bug.cgi?id=722106 https://bugzilla.gnome.org/show_bug.cgi?id=722106 in GTK triggered this problem: https://bugzilla.redhat.com/show_bug.cgi?id=1064695 https://bugzilla.redhat.com/show_bug.cgi?id=1064695 . > Not to mention that I can still write a keylogger that bypasses jwz's xscreensaver. [2] You can write a keylogger that bypasses pretty much anything that's X-based. To, uh, to put it bluntly, ditching X11 for something saner would be the correct approach. Stacking stuff on top of X11 makes the problem worse; not stacking anything leaves it pretty bad. I'm not overly optimistic about Wayland, but I guess we'll have to wait and see :-).

by Jasper_ 11y ago

digi_owl 11y ago

Didn't know that screen locks were supposed to defeat keyloggers. I thought they existed to stop people walking up to an unattended computer and mess around. Anyways, if i am reading the CVE right it is about how X11 can be provoked into maxing out its stack. Possibly annoying for those trying to use X11, but not something that leaks data. The more i see "security" discussed on HN, the more i feel that there needs to be a ranking system. All to often it seems like people are operating with a binary definition of security, putting anything with a CVE in the insecure bin.

johnchristopher 11y ago

I believe this blog post http://blog.martin-graesslin.com/blog/2015/01/why-screen-lockers-on-x11-cannot-be-secure/ http://blog.martin-graesslin.com/blog/2015/01/why-screen-loc... is relevant to the conversation and the key logger part (but I am out of my league to comment about it).

notalaser 11y ago

> But why can he vouch that libX11 is any more secure? The library that runs complex input method code on every key-press, that has had CVEs in it? [0] [1] GTK (at least the 2.x series, I don't know if that's changed in 3.x) uses libx11. There's a good chance that, if there's a major flaw in libx11 which can be exploited, a GTK-based program is vulnerable to it. GTK is pretty massive, so it likely introduces issues of its own. E.g. this bug: https://bugzilla.gnome.org/show_bug.cgi?id=722106 https://bugzilla.gnome.org/show_bug.cgi?id=722106 in GTK triggered this problem: https://bugzilla.redhat.com/show_bug.cgi?id=1064695 https://bugzilla.redhat.com/show_bug.cgi?id=1064695 . > Not to mention that I can still write a keylogger that bypasses jwz's xscreensaver. [2] You can write a keylogger that bypasses pretty much anything that's X-based. To, uh, to put it bluntly, ditching X11 for something saner would be the correct approach. Stacking stuff on top of X11 makes the problem worse; not stacking anything leaves it pretty bad. I'm not overly optimistic about Wayland, but I guess we'll have to wait and see :-).