4 ms·

> It's also about programs being able to hack into your accounts by keylogging you or stealing passwords from your clipboard Honest question: why does this mat

by jowea 3y ago

> It's also about programs being able to hack into your accounts by keylogging you or stealing passwords from your clipboard Honest question: why does this matter? If you end up with running malware as your user haven't you already "lost" in any of a wide variety of ways that Wayland does nothing against? Or is it that Wayland is trying to bring the mobile security model to the desktop with partially untrusted apps?

Bu9818 3y ago
>Honest question: why does this matter? If you end up with running malware as your user haven't you already "lost" in any of a wide variety of ways that Wayland does nothing against? The security benefits of wayland are useful when you're also using other things like namespaces/seccomp (with bubblewrap/flatpak), and pipewire which I believe has a similar access control mechanism. >Or is it that Wayland is trying to bring the mobile security model to the desktop with partially untrusted apps? I trust my programs, but they can have bugs when parsing untrusted content. (ffmpeg, browsers). Although I've never been hacked, I'd like my systems to have defenses against this (without going full mobile security mode and giving up functionality and user freedom, or running everything in inconvenient isolated boxes with VMs). Also, I'm not sure if I'd trust proprietary games, so preventing them from doing naive things (I don't expect them to exploit kernel vulns) like snooping on files by using namespaces is nice.
pacifika 3y ago
I think untrusted user input can exclude maliciously crafted urls and other ways where the user is not you.
roenxi 3y ago
Building one wall doesn't keep you dry in a house when it rains. You need 4 walls and a roof. But the Linux ecosystem builds up to things bit by bit. So in this case, Wayland is progress towards a goal where untrusted apps can be run and are limited in what they can do by design. It doesn't matter at the moment, but one day it'll be an important brick in a secure system.
- grotorea 3y ago
  So, it will really matter when everything runs in a container or AppArmor or something like that. I wonder if that will ever be made convenient and "it just works" without having the impression of having apps being on somewhat inconvenient silos.
charcircuit 3y ago
>bring the mobile security model to the desktop with partially untrusted apps? That isn't a mobile security model. It's a good and more modern security model. Desktop operating systems are moving this way too but it's harder due to apps not originally being designed for it.
phkahler 3y ago
>> Honest question: why does this matter? If you end up with running malware as your user haven't you already "lost" in any of a wide variety of ways that Wayland does nothing against? No. Your web browser does a pretty good job of not storing your login info (if you tell it not to) locally. Under X, malware can monitor everything you do and log your credentials. Under Wayland it can not. Simple as that. Malware will still try to exploit bugs and CVEs to get access, but finding a hole in a wall is entirely different than not having a wall in the first place. Holes can be patched. People run untrusted code on their machines every day. Most of it is in the browser (which has walls) and is written by advertisers that are not well scrutinized by the sites people visit. Then there is the whole trend of containers which put more walls around native apps. So in your question, replace malware" with "untrusted code" and it becomes more realistic.
- mcpackieh 3y ago
  If you have malware running with your user permissions, your entire browser can be swapped out with a hacked version that keylogs you. The entire GNU/Linux desktop security model falls to pieces the moment you have malware running with your user permissions, there's a sword of Damocles hanging above you by a meter long thread of silk and Wayland proposes to replace one centimeter of that string with a steel cable. Great, 99 cm of that string is still silk thread so nothing has changed. Anyway to echo beanjuiceII's point, number of times I've been pwned by an X keylogger: Zero.
  - Volundr 3y ago
    > number of times I've been pwned by an X keylogger: Zero. (That you know of). Number of times I've been pwned by any technical vector (that I know of): zero. The fact it hasn't happened to you does not imply that defending against it is pointless. Early in my computing career I used the same weak password for everything. Never had an account takeover. That does not imply that using different secure passwords for each site is pointless.
    - mcpackieh 3y ago

by jowea 3y ago

Bu9818 3y ago

>Honest question: why does this matter? If you end up with running malware as your user haven't you already "lost" in any of a wide variety of ways that Wayland does nothing against? The security benefits of wayland are useful when you're also using other things like namespaces/seccomp (with bubblewrap/flatpak), and pipewire which I believe has a similar access control mechanism. >Or is it that Wayland is trying to bring the mobile security model to the desktop with partially untrusted apps? I trust my programs, but they can have bugs when parsing untrusted content. (ffmpeg, browsers). Although I've never been hacked, I'd like my systems to have defenses against this (without going full mobile security mode and giving up functionality and user freedom, or running everything in inconvenient isolated boxes with VMs). Also, I'm not sure if I'd trust proprietary games, so preventing them from doing naive things (I don't expect them to exploit kernel vulns) like snooping on files by using namespaces is nice.

pacifika 3y ago

I think untrusted user input can exclude maliciously crafted urls and other ways where the user is not you.

roenxi 3y ago

Building one wall doesn't keep you dry in a house when it rains. You need 4 walls and a roof. But the Linux ecosystem builds up to things bit by bit. So in this case, Wayland is progress towards a goal where untrusted apps can be run and are limited in what they can do by design. It doesn't matter at the moment, but one day it'll be an important brick in a secure system.

grotorea 3y ago
So, it will really matter when everything runs in a container or AppArmor or something like that. I wonder if that will ever be made convenient and "it just works" without having the impression of having apps being on somewhat inconvenient silos.

charcircuit 3y ago

>bring the mobile security model to the desktop with partially untrusted apps? That isn't a mobile security model. It's a good and more modern security model. Desktop operating systems are moving this way too but it's harder due to apps not originally being designed for it.

phkahler 3y ago

>> Honest question: why does this matter? If you end up with running malware as your user haven't you already "lost" in any of a wide variety of ways that Wayland does nothing against? No. Your web browser does a pretty good job of not storing your login info (if you tell it not to) locally. Under X, malware can monitor everything you do and log your credentials. Under Wayland it can not. Simple as that. Malware will still try to exploit bugs and CVEs to get access, but finding a hole in a wall is entirely different than not having a wall in the first place. Holes can be patched. People run untrusted code on their machines every day. Most of it is in the browser (which has walls) and is written by advertisers that are not well scrutinized by the sites people visit. Then there is the whole trend of containers which put more walls around native apps. So in your question, replace malware" with "untrusted code" and it becomes more realistic.

mcpackieh 3y ago
If you have malware running with your user permissions, your entire browser can be swapped out with a hacked version that keylogs you. The entire GNU/Linux desktop security model falls to pieces the moment you have malware running with your user permissions, there's a sword of Damocles hanging above you by a meter long thread of silk and Wayland proposes to replace one centimeter of that string with a steel cable. Great, 99 cm of that string is still silk thread so nothing has changed. Anyway to echo beanjuiceII's point, number of times I've been pwned by an X keylogger: Zero.
- Volundr 3y ago
  > number of times I've been pwned by an X keylogger: Zero. (That you know of). Number of times I've been pwned by any technical vector (that I know of): zero. The fact it hasn't happened to you does not imply that defending against it is pointless. Early in my computing career I used the same weak password for everything. Never had an account takeover. That does not imply that using different secure passwords for each site is pointless.
  - mcpackieh 3y ago