7
Condor
141d

So just now I had to focus on a VM running in virt-manager.. common stuff, yeah. It uses a click of le mouse button to focus in, and Ctrl-Alt-L to release focus. Once focused, the VM is all there is. So focus, unfocus, important!

Except Mate also uses Ctrl-L to lock the screen. Now I actually don't know the password to my laptop. Autologin in lightdm and my management host can access both my account and the root account (while my other laptop uses fingerprint authentication to log in, but this one doesn't have it). Conveniently my laptop can also access the management host, provided a key from my password manager.. it makes more sense when you have a lot of laptops, servers and other such nuggets around. The workstations enter a centralized environment and have access to everything else on the network from there.

Point is, I don't know my password and currently this laptop is the only nugget that can actually get this password out of the password store.. but it was locked. You motherfucker for a lock screen! I ain't gonna restart lightdm, make it autologin again and lose all my work! No no no, we can do better. So I took my phone which can also access the management host, logged in as root on my laptop and just killed mate-screensaver instead. I knew that it was just an overlay after all, providing little "real" security. And I got back in!

Now this shows an important security problem. Lock screens obviously have it.. crash the lock screen somehow, you're in. Because behind that (quite literally) is your account, still logged in. Display managers have it too to some extent, since they run as root and can do autologin because root can switch user to anyone else on the system without authentication. You're not elevating privileges by logging in, you're actually dropping them. Just something to think about.. where are we just adding cosmetic layers and where are we actually solving security problems? But hey, at least it helped this time. Just kill the overlay and bingo bango, we're in!

Comments
  • 1
    Security problems can be both good and bad at the same time as we can see from this rant.
  • 2
    @-ANGRY-STUDENT- exactly! And this is not the only example of it either. Before I added my WiFi password to my password manager, I legit logged into my Raspberry Pi and looked at /etc/wpa_supplicant/wpa_supplicant.conf because that contains the plain copy of the WiFi password. And because of how Raspbian is designed, can be viewed by anyone (granted there's also passwordless sudo so that doesn't matter much, it's already fucked in other ways). And that's a problem with WPA2 and credential retention in general really - NetworkManager for example also has it elsewhere... You cannot have a requirement for human interaction in an automated system component (like network authentication, file shares etc). But how else do you authenticate? Well.. you store it on disk. And if your name is Raspbian, you make it visible to everyone... Yeah, that's how we solved that. :')
Add Comment