What is the worst a browser exploit could do in Ubuntu?

[Hungry Man]

Yeah, most of the information out there is actually related to Qubes because a lot of people refuse to discuss it.

It solves this by implementing X in a way that should be default - multiple X sessions and isolating user accounts.

[Stonecold1995]

It solves this by implementing X in a way that should be default - multiple X sessions and isolating user accounts.

Isn't Wayland suppose to do that as well?

[Hungry Man]

I think Wayland requires root for global hotkeys. I've only ever heard about GUI isolation in it, never seen official documentation.

[BigCityCat]

From a lay mens point of view. Is a minimized application using x session? Also is keepassx perform auto type function or copied to clip board information encrypted?

If it is then as long as keepassx is the only app open when you put in the master password you would be safe. I mean wouldn't you have to have a malicious app or infected browser open to implement.

[Hungry Man]

A minimized application is using X/ has X access. It's not so much that an application has to be using X so much as it needs to have access to X.

But yes, you would either need a malicious application with X access or some process with X access would have to have been exploited.

[BigCityCat]

Thanks

I think just to be safe I will run a dedicated browser with no addons, a clean history and keepassx only... when dealing with sensitive information. Obviously it's probably not an issue but why not.

[BigCityCat]

A minimized application is using X/ has X access. It's not so much that an application has to be using X so much as it needs to have access to X.

But yes, you would either need a malicious application with X access or some process with X access would have to have been exploited.

Does the clipboard use x?

[Hungry Man]

I believe so.

[BigCityCat]

Well under those circumstances an infected app or process could read your master password and any info used with the clipboard provided both were using x at the same time.

I think the Wayland team is aware of this issue and has plans to try and deal with it. I found this link on the Wayland devel mailing list where the primary developer of Qubes OS has an interesting exchange with a Wayland developer.

http://comments.gmane.org/gmane.comp...and.devel/1867

I would be interested in some of you guys take on the Wayland developers response.

[Hungry Man]

They state "don't give a program session access" but we're talking about exploited programs, so it's different. But they do state that keys aren't broadcasted globally, they're handled by the compositor, which is what I expected them to do.

I'll finish reading and give a better response later.