5 ms·

Especially here, where it’s (probably?) not remotely exploitable.

by monochromatic 9y ago

zamalek 9y ago
> probably Show and focus a window when the user locks their machine.
- brazzledazzle 9y ago
  Yeah. You can do keystroke logging without root but typing into password fields can't be intercepted. This would be a nice complement to that capability.
  - throwawaymanbot 9y ago
    Interestingly, someone mentioned on twitter the same thing happening to them on ubuntu With slack. Would this be an issue with slack interjecting itself for key strokes?
- daveFNbuck 9y ago
  How do you do that?
  - fleitz 9y ago
    - (void) viewDidAppear{ [super viewDidAppear]; [self.passwordfield becomeFirstResponder]; }
    - fleitz 9y ago
      I guess I got down voted for Obj C code, here's the swift version: func viewDidAppear(){ super.viewDidAppear() passwordField.becomeFirstResponder() }
blattimwind 9y ago
Having your password in some IRC channel gets remotely exploitable quickly.
- floatboth 9y ago
  If you reused the password, yeah, instant pwnage everywhere. If your local account password isn't used anywhere else, meh, random IRC people don't have physical access to your machine :)
  - pornel 9y ago
    Unless you have remote SSH logon enabled and IRC exposes your IP address.
    - Fnoord 9y ago
      Depends how you authenticate with your password. You could use pubkey with or without a password. Even if you reuse the password there, even if they have your password, if they don't have your private key they can't authenticate.
    - cuckcuckspruce 9y ago
      Yet another reason to only use SSH keys.
    - floatboth 9y ago
      Remote logon with passwords allowed and sshd exposed to the whole internet (not behind ISP's NAT, not behind home NAT, port allowed on home firewall, port allowed on laptop firewall).
  - davrosthedalek 9y ago
    No need to reuse your password. If the machine has sshd enabled, the attacker only has to guess the account name, but that's hopefully a lot easier than guessing the password.
- bartvk 9y ago

Especially here, where it’s (probably?) not remotely exploitable.

zamalek 9y ago

> probably Show and focus a window when the user locks their machine.

brazzledazzle 9y ago
Yeah. You can do keystroke logging without root but typing into password fields can't be intercepted. This would be a nice complement to that capability.
- throwawaymanbot 9y ago
  Interestingly, someone mentioned on twitter the same thing happening to them on ubuntu With slack. Would this be an issue with slack interjecting itself for key strokes?
daveFNbuck 9y ago
How do you do that?
- fleitz 9y ago
  - (void) viewDidAppear{ [super viewDidAppear]; [self.passwordfield becomeFirstResponder]; }
  - fleitz 9y ago
    I guess I got down voted for Obj C code, here's the swift version: func viewDidAppear(){ super.viewDidAppear() passwordField.becomeFirstResponder() }

blattimwind 9y ago

Having your password in some IRC channel gets remotely exploitable quickly.

floatboth 9y ago
If you reused the password, yeah, instant pwnage everywhere. If your local account password isn't used anywhere else, meh, random IRC people don't have physical access to your machine :)
- pornel 9y ago
  Unless you have remote SSH logon enabled and IRC exposes your IP address.
  - Fnoord 9y ago
    Depends how you authenticate with your password. You could use pubkey with or without a password. Even if you reuse the password there, even if they have your password, if they don't have your private key they can't authenticate.
  - cuckcuckspruce 9y ago
    Yet another reason to only use SSH keys.
  - floatboth 9y ago
    Remote logon with passwords allowed and sshd exposed to the whole internet (not behind ISP's NAT, not behind home NAT, port allowed on home firewall, port allowed on laptop firewall).
- davrosthedalek 9y ago
  No need to reuse your password. If the machine has sshd enabled, the attacker only has to guess the account name, but that's hopefully a lot easier than guessing the password.
bartvk 9y ago