4 ms·

Could you elaborate on that? Of course no computer is completely secure against all forms of attack, but I’ve found statements like these to not contribute very

Could you elaborate on that? Of course no computer is completely secure against all forms of attack, but I’ve found statements like these to not contribute very much towards solving any practical security problems.

grenoire 6y ago
The moment that a string of text appears on your screen, it is passed through between many different functions (and even pieces of hardware, with textures being stored on the GPU VRAM) and has unencrypted copies laying all around in memory as the application is running. Any part of the space in which these copies exist being compromised will mean that your encryption is useless in the end.
- rosswilson 6y ago
  You have to draw the line somewhere. Otherwise we'd be saying that HTTPS/TLS is not secure since the webpage is rendered to your monitor unencrypted. I agree with the parent quote: > I’ve found statements like these to not contribute very much towards solving any practical security problems.
  - vultour 6y ago
    But HTTP/TLS indeed is not secure from the point of your local machine. Its entire point is protection of data in transit.
wongarsu 6y ago
On windows any program can read the contents of any window on the current desktop (with some exceptions, like UAC prompts and other windows that dim your entire screen). This has legimate use cases for screen readers or dictation, but of course it can also be abused. Same for X11. On more modern operating systems like Android the user needs to take very explicit action to allow an app to do that.
- andrewnicolalde 6y ago
  Wow, I had no idea this was also the case on Windows! I was aware of this on X11 and switched to a Wayland compositor as a result. Is this true for macOS? I know for sure that on more recent versions of macOS, applications which want to capture the entire screen require special user-approved permissions, but can they selectively read other windows?

grenoire 6y ago

The moment that a string of text appears on your screen, it is passed through between many different functions (and even pieces of hardware, with textures being stored on the GPU VRAM) and has unencrypted copies laying all around in memory as the application is running. Any part of the space in which these copies exist being compromised will mean that your encryption is useless in the end.

rosswilson 6y ago
You have to draw the line somewhere. Otherwise we'd be saying that HTTPS/TLS is not secure since the webpage is rendered to your monitor unencrypted. I agree with the parent quote: > I’ve found statements like these to not contribute very much towards solving any practical security problems.
- vultour 6y ago
  But HTTP/TLS indeed is not secure from the point of your local machine. Its entire point is protection of data in transit.

wongarsu 6y ago

On windows any program can read the contents of any window on the current desktop (with some exceptions, like UAC prompts and other windows that dim your entire screen). This has legimate use cases for screen readers or dictation, but of course it can also be abused. Same for X11. On more modern operating systems like Android the user needs to take very explicit action to allow an app to do that.

andrewnicolalde 6y ago
Wow, I had no idea this was also the case on Windows! I was aware of this on X11 and switched to a Wayland compositor as a result. Is this true for macOS? I know for sure that on more recent versions of macOS, applications which want to capture the entire screen require special user-approved permissions, but can they selectively read other windows?