3 ms·

> Arguably, you have been 'taught' or you have inferred yourself that you should expect a sleeping system to immediately accept your keypresses as a password, w

> Arguably, you have been 'taught' or you have inferred yourself that you should expect a sleeping system to immediately accept your keypresses as a password, which although reasonable is not necessarily a good practice. I fail to see why that wouldn't be a "good practice". Last weekend I read some articles on Canon Cat[1], and Jef Raskin referred[2] to the feature as something desirable: > In many ways it was, for 1987, far ahead. [...] instant on with any keystroke (and you didn't even lose the keystroke) He goes on to explain why it's a good idea to do so in the article, it's a good read. [1] https://en.wikipedia.org/wiki/Canon_Cat https://en.wikipedia.org/wiki/Canon_Cat [2] https://www.apple-history.com/gui_raskin2 https://www.apple-history.com/gui_raskin2

d1sxeyes 5y ago
Thanks for sharing. I can definitely see why it might be appealing. However, using Ctrl + Alt + Del guarantees that only Winlogon can handle the logon, no other process can be simulating the login prompt. My dad told me about a program he wrote for a PDP-11 which would just simulate a login prompt. When a username and password were entered, it would append it to a file somewhere, then print the 'Incorrect username or password' message, and exit silently. The user would assume they'd fat-fingered the password, and try to log in again (successfully) and be none the wiser that their password had just been stolen. The Windows dependency on Ctrl+Alt+Del makes this type of attack impossible, while systems that don't require a Secure Attention Sequence (as apparently it is called) to log in are susceptible to a slightly more sophisticated version of this attack.
- klibertp 5y ago
  I see. It makes sense, and it's a valid concern that I didn't think of. Personally, I prefer the convenience of continuing where I left off with as little friction as possible, so I don't even lock the session when the screensaver kicks in. But I never take my laptop outside, and the threat of malware is considerably lower under Linux. If that wasn't true, I would probably also want to err on the side of caution. Choosing a specific key (I have a very conveniently positioned X86WakeUp physical button) or combination for waking up and getting to login prompt seems like a good idea in that case.

d1sxeyes 5y ago

Thanks for sharing. I can definitely see why it might be appealing. However, using Ctrl + Alt + Del guarantees that only Winlogon can handle the logon, no other process can be simulating the login prompt. My dad told me about a program he wrote for a PDP-11 which would just simulate a login prompt. When a username and password were entered, it would append it to a file somewhere, then print the 'Incorrect username or password' message, and exit silently. The user would assume they'd fat-fingered the password, and try to log in again (successfully) and be none the wiser that their password had just been stolen. The Windows dependency on Ctrl+Alt+Del makes this type of attack impossible, while systems that don't require a Secure Attention Sequence (as apparently it is called) to log in are susceptible to a slightly more sophisticated version of this attack.

klibertp 5y ago
I see. It makes sense, and it's a valid concern that I didn't think of. Personally, I prefer the convenience of continuing where I left off with as little friction as possible, so I don't even lock the session when the screensaver kicks in. But I never take my laptop outside, and the threat of malware is considerably lower under Linux. If that wasn't true, I would probably also want to err on the side of caution. Choosing a specific key (I have a very conveniently positioned X86WakeUp physical button) or combination for waking up and getting to login prompt seems like a good idea in that case.