>Apparently X11 has the SECURITY and XACE extensions which are theoretically capable of preventing this, but nobody uses them ... My experience is that the SEC

>Apparently X11 has the SECURITY and XACE extensions which are theoretically capable of preventing this, but nobody uses them ... My experience is that the SECURITY extension is universal these days using MIT-MAGIC-COOKIE-1. To do otherwise would be insane as any user on the system would be able to sniff your keystrokes and mess with your windows. That would include utility users and probably even chrooted stuff. However in this case the SECURITY extension is specifically overridden by copying the ~/.Xauthority file to the browser user. So your comment is still valid. The article discusses the performance implications of not doing the override.