[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
On 15/07/2020 21:18, comrade meowski wrote:
This reminds me of when Warwick University computer services labs, first rolled out their X-terms to students, it wasn't long before everyone, working an X server from multiple terminals found out that they could control all the input systems (mice and keyboards) that were running off lily.csv.warwick.ac.uk, and before long the sysadmins closed down the labs, fixed the problems and re-opened them.On 15/07/2020 19:33, rich@xxxxxxxxxxx wrote:So should we stop it and is that possible please?It's a critical part of your operating system's design and functionality set - for a normal end user, this is definitely not something you should worry about. Xorg (and Wayland) both implement this and it's a feature, not a bug.The first casualty of disabling it would be your password manager and things would only get worse from there.The old method of dealing with this (for the paranoid, like me) is to install a clipboard manager with various privacy options available such as one that stores multiple copy buffers by moving them into it's own secured storage unreachable by - for example - web browser clipboard APIs and also repeatedly zeroes out any current "main" clipboard buffer content periodically.This isn't a new problem by any stretch of the imagination - if you examine the options in your password manager tool(s) you'll see most of them implement a delayed wipe of your clipboard buffer so as to avoid leaving sensitive information effectively visible to anything that requests it. Obviously this is so they can work in the first place (by utilising the clipboard to temporarily store your username+password combos on route to the browser) but also don't just leave the info in the buffer for the next craptastic app that asks for it.One for you to file under "don't worry about it" basically.
(Read in to this: it is how you configure your system that causes it to have a security issue, not the system itself, the system has no concept of security, you do.).
-- Giles Coochey -- The Mailing List for the Devon & Cornwall LUG https://mailman.dcglug.org.uk/listinfo/list FAQ: http://www.dcglug.org.uk/listfaq