Re: xscreensaver and ssh-agent

[Brian May <bam@debian.org>]

>>>>> "Jules" == Jules Bean <jules@jellybean.co.uk> writes:

    Jules> Clever stuff, but people shouldn't get a false sense of
    Jules> security. This is damage limitation, at best. If someone
    Jules> has cracked root on your own machine, they can kidnap any
    Jules> running ssh connections (and so gain any privileges you
    Jules> have 'open') while the screensaver is on.

Depends on you how you work with your computer.

For instance, if I happen to be logged on to computer A while the
xscreensaver locks the computer, an attacker will not be able to log
on to computer B, C, or D. So damage is isolated to computer A.

However, an attacker could wait until you come back to your computer,
run ssh-agent, and then log into B, C, or D. So, depending on your
point of view, you could argue that this security measure is useless.

My opinion is that anything that helps get rid of your privileges, for
when they aren't being used, can only be a good thing, and the worst
problem it can cause is the time taken to get these privileges back
again.
-- 
Brian May <bam@debian.org>