bugtraq - Re: Another Mac OS X ScreenSaver Security Issue (after Security Update 2003-07-14)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20030801064553.GA11035@nimitz.net>
Date: Thu, 31 Jul 2003 23:45:53 -0700
From: Randy Kaelber <randall@...itz.net>
To: Rizwan Jiwan <Rizwan.Jiwan@...GSTON.Hummingbird.com>
Subject: Re: Another Mac OS X ScreenSaver Security Issue (after Security Update 2003-07-14)

On Thu, Jul 31, 2003 at 01:21:28PM -0400, Rizwan Jiwan wrote:
> I wouldn't consider this a bug. It is like me writing a script that kills
> any process named "ScreenSaverEngine". If I run it with my privileges it
> should allow me to kill the process (assuming I own ScreenSaverEngine).
> Escape Pod does what it is meant to. OS X does what it is meant to--that is
> unless you are suggesting that the operating system not allow the user to
> kill the screen saver process which is just stupid because I have had my
> screen saver crash on me.

I agree. It's no more a security hole than having Ctrl-Alt-Backspace
enabled to kill one's X server when one starts X from the command line
with "startx"  rather than "exec startx".  This is a matter of good
security practice.  Relying on a screensaver app to provide you with real
security is probably not a good security practice.  Sticking a Post-it
note on one's monitor with root password written on it is certainly a bad
security practice.  However, neither of these practices are the fault of
the software.

Basing exceptions to rules on the name of the executable running sounds 
like a path towards madness, as well.
-- 
Randy Kaelber