3 ms·

Downthread: > This is why I have a `sudo` password entry wrapper that mutes the mic (yes, really). That’s a nifty concept for hardening security a bit. I imag

Downthread: > This is why I have a `sudo` password entry wrapper that mutes the mic (yes, really). That’s a nifty concept for hardening security a bit. I imagine you might want to do the same for the camera (though that’s hopefully an even smaller risk than audio, unless you have a camera pointed at your hands or keyboard), blanking it briefly; I’m not intimately familiar with v4l2 or pipewire or whatever, but I don’t think video stuff has quite the same “mute” ability?

marcan_42 5y ago
My streams don't have camera feeds at all, so that's not a problem; I stream a full screen share only (except when I'm showing a camera pointed at a laptop screen in an ffplay window, but that's rare). For v4l2, I imagine the simplest hacky way to do it would be to change the camera settings to result in a pure black or otherwise unusable image (e.g. zero exposure, zero brightness). That can be done with v4l2-ctl. But at that point you're probably using OBS for streaming anyway, so you might as well just use the OBS-websocket API to hide or censor the camera frame instead (and mute the audio that way while you're at it).
BossingAround 5y ago
Sorry, for the slower of us, what does that mean? Muting a microphone with a script? Would the poster effectively keep their mic muted until they want to speak (and issue sudo commands two times every time they speak)?
- seanhunter 5y ago
  I think they mean mute the mic, do the actual sudo then unmute. A proof of concept script that I have hacked together from some other things I have (untested because I'm on my mac not my linux laptop atm) would look like this for linux #!/bin/bash set -euo pipefail #Get current mute status SINK=$( pactl list sinks | sed 's/Sink #//;q' ) current_pa=$(pactl list sinks | awk '/Mute/{print $2}' ) current_cap=$(amixer cset iface=MIXER,name='Capture Switch' | awk -F= '/: values/{print $2}') #mute it pactl set-sink-mute "${SINK}" 1 amixer cset iface=MIXER,name='Capture Switch' off,off > /dev/null /usr/bin/sudo "$@" #put it back the way it was before pactl set-sink-mute "${SINK}" $current_pa amixer cset iface=MIXER,name='Capture Switch' "$current_cap" > /dev/null I think you might only need the amixer part to mute the mic but I'm muting the speaker as well with pactl.
  - marcan_42 5y ago
    Close. That wouldn't work for long-running commands, since they'd keep the mic muted. Instead I use a sudo askpass wrapper to only mute during the password prompt bit.
    - BossingAround 5y ago
      What problem does it solve? You mute your mic, do sudo, then unmute it. Why?
      - seanhunter 5y ago
        There is an attack whereby if someone can record audio of you typing your password, they can get information helpful to cracking your password.
    - seanhunter 5y ago
      Oh yeah that makes more sense.
- chrismorgan 5y ago
  https://twitter.com/marcan42/status/1478883199510265857 https://twitter.com/marcan42/status/1478883199510265857: look at /etc/sudo.conf + askpass.
- chrisjc 5y ago
  Initially I thought they were muting the mic so that the key strokes would not be heard/recorded. There has been talk in the past of inferring passwords based on the unique sounds of each key, time between strokes, etc... Moreover, the more frequently you do broadcast your password keystrokes, combined with all the other key stroking you do throughout the rest of your stream, the easier it becomes to come up with the password. Now I'm not so sure that's what they meant?
  - chrismorgan 5y ago
    Muting the microphone while you type the password. That is, you run `sudo foo`, and it mutes the microphone before giving you the “[sudo] password for ‹username›: ” prompt, then unmutes it when you have entered the password and pressed Enter, and then runs `foo` as root.
    - chrisjc 5y ago
      Understood... but why are you doing this? Bc someone could decipher your passwords if you record the sound of your keystrokes while entering them?
      - marcan_42 5y ago
        Yes, it's what you initially thought. I sudo often enough during the streams that I could see someone trying to pull that off and succeeding.

marcan_42 5y ago

My streams don't have camera feeds at all, so that's not a problem; I stream a full screen share only (except when I'm showing a camera pointed at a laptop screen in an ffplay window, but that's rare). For v4l2, I imagine the simplest hacky way to do it would be to change the camera settings to result in a pure black or otherwise unusable image (e.g. zero exposure, zero brightness). That can be done with v4l2-ctl. But at that point you're probably using OBS for streaming anyway, so you might as well just use the OBS-websocket API to hide or censor the camera frame instead (and mute the audio that way while you're at it).

BossingAround 5y ago

Sorry, for the slower of us, what does that mean? Muting a microphone with a script? Would the poster effectively keep their mic muted until they want to speak (and issue sudo commands two times every time they speak)?

seanhunter 5y ago
I think they mean mute the mic, do the actual sudo then unmute. A proof of concept script that I have hacked together from some other things I have (untested because I'm on my mac not my linux laptop atm) would look like this for linux #!/bin/bash set -euo pipefail #Get current mute status SINK=$( pactl list sinks | sed 's/Sink #//;q' ) current_pa=$(pactl list sinks | awk '/Mute/{print $2}' ) current_cap=$(amixer cset iface=MIXER,name='Capture Switch' | awk -F= '/: values/{print $2}') #mute it pactl set-sink-mute "${SINK}" 1 amixer cset iface=MIXER,name='Capture Switch' off,off > /dev/null /usr/bin/sudo "$@" #put it back the way it was before pactl set-sink-mute "${SINK}" $current_pa amixer cset iface=MIXER,name='Capture Switch' "$current_cap" > /dev/null I think you might only need the amixer part to mute the mic but I'm muting the speaker as well with pactl.
- marcan_42 5y ago
  Close. That wouldn't work for long-running commands, since they'd keep the mic muted. Instead I use a sudo askpass wrapper to only mute during the password prompt bit.
  - BossingAround 5y ago
    What problem does it solve? You mute your mic, do sudo, then unmute it. Why?
    - seanhunter 5y ago
      There is an attack whereby if someone can record audio of you typing your password, they can get information helpful to cracking your password.
  - seanhunter 5y ago
    Oh yeah that makes more sense.
chrismorgan 5y ago
https://twitter.com/marcan42/status/1478883199510265857 https://twitter.com/marcan42/status/1478883199510265857: look at /etc/sudo.conf + askpass.
chrisjc 5y ago
Initially I thought they were muting the mic so that the key strokes would not be heard/recorded. There has been talk in the past of inferring passwords based on the unique sounds of each key, time between strokes, etc... Moreover, the more frequently you do broadcast your password keystrokes, combined with all the other key stroking you do throughout the rest of your stream, the easier it becomes to come up with the password. Now I'm not so sure that's what they meant?
- chrismorgan 5y ago
  Muting the microphone while you type the password. That is, you run `sudo foo`, and it mutes the microphone before giving you the “[sudo] password for ‹username›: ” prompt, then unmutes it when you have entered the password and pressed Enter, and then runs `foo` as root.
  - chrisjc 5y ago
    Understood... but why are you doing this? Bc someone could decipher your passwords if you record the sound of your keystrokes while entering them?
    - marcan_42 5y ago
      Yes, it's what you initially thought. I sudo often enough during the streams that I could see someone trying to pull that off and succeeding.