[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#869698: mate-desktop-environment: Not-remote security: On resume desktop with opened documents is exposed to eavesdropper before unlock prompt appear



Control: reassing -1 mate-screensaver

On  Di 25 Jul 2017 20:13:14 CEST, Sergio B. wrote:

Package: mate-desktop-environment
Version: 1.16.0+1
Severity: important

Dear Maintainer,

I do not know what package this issue exactly belongs to and I hope you know
that better and can forward this report if needed.
This issue survives for years, it existed in Debian 8 Mate and now I see it
with Debian 9 Mate again. It exists on two different laptops I use one i386
and
another amd64.

When system resumes from suspend2ram or (especially!) suspend2disk state the
first thing I see in graphics is Mate's desktop with all windows and
documents
were opened before I start suspend. A _moment_ later screen fades to black
or
hides desktop and switches to unlock prompt asking for password.
How long that "moment" is? It depends on speed of system, "weight" of
running
applications, amount of used swap, where (RAM/disk) resuming is being done
from. For fast machine with little load this issue may be invisible or
"almost
invisible" taking a second, for slow single core with swapping it happens
desktop is exposed to eavesdropper for dozens of seconds after resuming from
disk and before it is hidden behind password prompt.

Evil russian hackers have enough time to take photocamera and steal all my
secrets about my interference in Mordor's elections! Help! :)

Most likely an issue in mate-screensaver, so reassigining to that package.

Note, that there have been quite some changes in mate-screensaver recently (since MATE 1.20.2). Please re-test with that version (from Debian testing).

Mike
--

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
mobile: +49 (1520) 1976 148
landline: +49 (4354) 8390 139

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

Attachment: pgpk0VDUrxDEp.pgp
Description: Digitale PGP-Signatur


Reply to: