WelcomeWEFreedomWindsorEssexCounty-ActionCommunicationsRalliesResourcesSocialEventsWednesdayNightMeetings-ActivismAgoraAgorismCanadaCommonLawCommunityDataCentersDataCentresDoocracyFarmersMarketIntroductionsNaturalLawNewslettersOntarioOrganizingOutreachProjexProjexWikiRalliesResistanceAnalysisSoireesSoiréesWikiSpooksWindsorElectionsTop Subs
5
tech - - (+6|-2)
How do you mitigate the security issues in Xorg?(self)
5 commentsbyLarrySwinger

There is no program isolation in Xorg so any program can contain a keylogger and read the keystrokes you input in other programs. What do you do about this?

Personally I close apps. If my understanding is correct, a program needs to have a window before it can have a functional keylogger, so minimizing programs to the systray also suffices. Please correct me if I'm wrong. But that's what I do.

Edit: it turns out that minimizing to systray does nothing to mitigate this, they still have an X window.

Here's a poll for people who are into polls.

Comment preview

[-]Drewski4(+3|0)

I'm careful about what apps I install. I'm not opposed to Wayland per se, but autotype on KeePass doesn't work on it so I'm still on X11 for now.

parentlinkreply
[-]LarrySwinger2(+1|0)

I'm on vanilla Xorg still so my workaround is to close unnecessary programs. I like the simplicity of it. No need to have all my programs open all the time, they form a distraction anyway.

parentlinkreply
[-]x0x72(+1|0)

How does wayland do that? If the issue is that all xorg applications listen to the keyboard even if they aren't a focused window, then Wayland doesn't really plug the hole by not doing that.

Because there are periferal devices available to listen to in /dev/ regardless.

Edit: I didn't realize you have to be root to read those. Could have sword I've played with that without being root.

parentlinkreply
[-]LarrySwinger2(+1|0)

Admittedly, Wayland only provides a solution for Wayland native programs. I'm not fully aware how many programs have been ported to it as I don't use Wayland.

A solution I didn't include in the poll is XLibre, they apparently address this issue. It might be the way to go. I'll fix the poll.

Others have had the same confusion as you regarding input devices in /dev/. Maybe it didn't need root before.

parentlinkreply
[-]x0x72(+1|0)

This relates to some AI slop research I had already done. Apparently XLibre doesn't fix the issue. Its security enhancements over Xorg have more to do with being able to isolate groups of programs that either can or can't send Xorg commands to each other. I think maybe the kinds of commands xdotool tends to use? It's called Xnamespace Extension.

But the keylogging potential is still there.

So cool. If I'm a power user I can put one application in one namespace and the rest in another, and a malicious program can't ... resize one of my windows. But maybe things like xdotool can also send keystrokes.

Still doesn't seem practical. When was the last time you've explicitly put an application into a seperate X11 namespace? But now I guess someone can.

parentlinkreply