<story><title>Kids find a security flaw in Linux Mint by mashing keys</title><url>https://github.com/linuxmint/cinnamon-screensaver/issues/354</url></story><parent_chain><item><author>datenwolf</author><text>It&amp;#x27;s not an X11 design flaw. The very concept of locking the screen is flawed. A flaw that also haunts Wayland, BTW.&lt;p&gt;The concept of screen lockers is having a special layer, that can&amp;#x27;t be bypassed, which a locker creates. The whole security then hinges on the locker not crashing. X11 does have such a layer. Wayland compositors also implement it through such a layer. And for either the situation is, that if the locker crashes, that layer is destroyed by implication and the session exposed.&lt;p&gt;That&amp;#x27;s a flawed concept.&lt;p&gt;What you really want is &lt;i&gt;detachable&lt;/i&gt; graphics session. On the text console one can effortlessly use screen or tmux and to &amp;quot;lock&amp;quot; the session simply detach and exit to the regular login getty.&lt;p&gt;You want &lt;i&gt;exactly&lt;/i&gt; the same, but for X11. And there&amp;#x27;s no obstacle in printiple to implement this. It&amp;#x27;s just that the Xorg server can&amp;#x27;t detach. Almost all of the required code is there, fundamentally it&amp;#x27;d be the same code that&amp;#x27;s executed during a VT switch.&lt;p&gt;In the meantime one can use Xpra with Xvfb to create detachable X11 sessions, which then however lack GPU acceleration.</text></item><item><author>astrange</author><text>Bad design in X11 which can&amp;#x27;t be fixed.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=25801693&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=25801693&lt;/a&gt;</text></item><item><author>gambiting</author><text>Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock screen appeared. I guess it&amp;#x27;s because the lockscreen was a separate process that had to start up? Still, what an awful awful design.</text></item></parent_chain><comment><author>shawnz</author><text>The architecture you&amp;#x27;re describing would also be good for other reasons. For example, you could start a local session, lock it, and then remotely connect to the same session over VNC without local users at the workstation being able to see or interfere with what you are doing, just as on Windows.&lt;p&gt;Mac OS almost gets this right, except it annoyingly defaults to sharing the remote session with the local console unless someone is already logged in locally.</text></comment>
<story><title>Kids find a security flaw in Linux Mint by mashing keys</title><url>https://github.com/linuxmint/cinnamon-screensaver/issues/354</url></story><parent_chain><item><author>datenwolf</author><text>It&amp;#x27;s not an X11 design flaw. The very concept of locking the screen is flawed. A flaw that also haunts Wayland, BTW.&lt;p&gt;The concept of screen lockers is having a special layer, that can&amp;#x27;t be bypassed, which a locker creates. The whole security then hinges on the locker not crashing. X11 does have such a layer. Wayland compositors also implement it through such a layer. And for either the situation is, that if the locker crashes, that layer is destroyed by implication and the session exposed.&lt;p&gt;That&amp;#x27;s a flawed concept.&lt;p&gt;What you really want is &lt;i&gt;detachable&lt;/i&gt; graphics session. On the text console one can effortlessly use screen or tmux and to &amp;quot;lock&amp;quot; the session simply detach and exit to the regular login getty.&lt;p&gt;You want &lt;i&gt;exactly&lt;/i&gt; the same, but for X11. And there&amp;#x27;s no obstacle in printiple to implement this. It&amp;#x27;s just that the Xorg server can&amp;#x27;t detach. Almost all of the required code is there, fundamentally it&amp;#x27;d be the same code that&amp;#x27;s executed during a VT switch.&lt;p&gt;In the meantime one can use Xpra with Xvfb to create detachable X11 sessions, which then however lack GPU acceleration.</text></item><item><author>astrange</author><text>Bad design in X11 which can&amp;#x27;t be fixed.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=25801693&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=25801693&lt;/a&gt;</text></item><item><author>gambiting</author><text>Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock screen appeared. I guess it&amp;#x27;s because the lockscreen was a separate process that had to start up? Still, what an awful awful design.</text></item></parent_chain><comment><author>zadler</author><text>It’s amazing to me that The most popular display managers on Linux have this flaw. Perhaps there is a workaround involving switching to another tty?</text></comment>