Page 3 of 3 FirstFirst 123
Results 21 to 26 of 26

Thread: Nautilus MASSIVE security fail?

  1. #21
    Join Date
    Jul 2011
    Beans
    9

    Re: Nautilus MASSIVE security fail?

    @MG&TL - that's the kind of answer I was looking for, I'll deal with that in a second. Let me first deal with some of the people who ironically think I'm an idiot.

    @haqking - you already agree with me that privacy and security are related, depending on context. But again I dispute "someone other than you has access to the thumbnails then security has already been compromised and then in addition your privacy also." Different levels of encryption exist. You might get my PC. You might be able to decrypt my home folder relatively easily. You still won't be able to decrypt my TrueCrypt volume - it has a higher level of encryption. So why would I store the thumbnails from the that volume in my home dir - that is plain and simply a leak from a higher security level to a lower one.

    @snowpine - I agree, but caching thumbnails is a bit different from saving files. If I load a document from secure storage, modify it and save it, where does it default the file save directory? Does it save a copy in ~me? I hope not!

    @SeanBlader - my house is also locked. The difference is, if someone breaks in, steals my computer, they cannot read my documents without a lot of effort. More importantly, they cannot read the subset of those documents that I consider private without a ENORMOUS amount more effort - probably more than anyone apart from a government agency could bring to bear. You have some idea how powerful GPUs are at encryption cracking, but you don't seem to recognise the massive difference in degree between hacking open a home folder protected by an 8 char password and hacking open a TC volume protected by a 40 char one. I'm afraid the actual facts are against you on this one - it simply isn't the case that just because some encryption is easy to crack, that all of it is equally easy, which is the implication of your assertion.

    Perhaps I annoyed people by calling this a 'massive' security fail, although at least I got your attention. But really folks, in security circles, a mechanism that leaks some information from one security level to another, lower one is generally considered to have a problem. I still have no reason to believe this is wrong.

    What I do have, thanks to MG&TL, is finally an argument in favour of putting thumbnails in ~me that is more than "that's just the way we've always done it, deal with it"

    >>1) It's more difficult to code for. If you've already got to figure out if you've got permissions on the drive to store thumbnails, whether the drive has the capacity or bandwidth required to store thumbnails (think floppy drives, one-write CDs, network shares), and whether the drive is nearly full or not, then thumbnailing is more of a headache.

    Yes, I completely agree with that.

    >>2) It could slow down I/O traffic on old or network storage.

    Yes, it could, although can it work the other way around? Having local thumbnails to old / network storage could slow you down, like the old windows explorer disappeared network share problem? I'm not sure.

    >>3) Dumping thumbnails in the directory they're in leaves rubbish all over the places you view in a file manager.

    I'm less convinced about this, because you're going to get rubbish somewhere - either one copy on the network share, or every user has a copy, which is inherently more wasteful and less secure.

    Ok, in the light of that, it seems to me that the problem is that Nautilus thumbnailing is not sufficiently granular. How about it thumbnails everything that is mounted below /home/you in /home/you/.thumbnails but it only caches thumbnails from other mountpoints to RAM?

  2. #22
    Join Date
    Jun 2011
    Location
    The Shadow Gallery
    Beans
    6,744

    Re: Nautilus MASSIVE security fail?

    Quote Originally Posted by jhwoods View Post

    @haqking - you already agree with me that privacy and security are related, depending on context. But again I dispute "someone other than you has access to the thumbnails then security has already been compromised and then in addition your privacy also." Different levels of encryption exist. You might get my PC. You might be able to decrypt my home folder relatively easily. You still won't be able to decrypt my TrueCrypt volume - it has a higher level of encryption. So why would I store the thumbnails from the that volume in my home dir - that is plain and simply a leak from a higher security level to a lower one.
    Why dont you encrypt your home directory with truecrypt then ?

    The thread title and content implies that this a major concern and that Ubuntu and Linux doesnt have any other security flaws, there are hundreds, alot of which can be addressed by the user, you have already encrypted using truecrypt to protect data, so use it to protect your home directory if your thumbnails are precious.

    Peace
    Backtrack - Giving machine guns to monkeys since 2006
    Kali-Linux - Adding a grenade launcher to the machine guns since 2013

  3. #23
    Join Date
    Jun 2011
    Location
    United Kingdom
    Beans
    Hidden!
    Distro
    Lubuntu Development Release

    Re: Nautilus MASSIVE security fail?

    Quote Originally Posted by jhwoods View Post
    >>3) Dumping thumbnails in the directory they're in leaves rubbish all over the places you view in a file manager.

    I'm less convinced about this, because you're going to get rubbish somewhere - either one copy on the network share, or every user has a copy, which is inherently more wasteful and less secure.

    Ok, in the light of that, it seems to me that the problem is that Nautilus thumbnailing is not sufficiently granular. How about it thumbnails everything that is mounted below /home/you in /home/you/.thumbnails but it only caches thumbnails from other mountpoints to RAM?
    Those are fair points you have. While I wouldn't say it was a security failure per se, it's certainly worth the developers having a think about. I guess you could raise a bug on the GNOME bugzilla. They could at least encrypt the thumbnail directory.

  4. #24
    Join Date
    Jun 2011
    Location
    The Shadow Gallery
    Beans
    6,744

    Re: Nautilus MASSIVE security fail?

    Quote Originally Posted by MG&TL View Post
    Those are fair points you have. While I wouldn't say it was a security failure per se, it's certainly worth the developers having a think about. I guess you could raise a bug on the GNOME bugzilla. They could at least encrypt the thumbnail directory.
    Wont happen
    Backtrack - Giving machine guns to monkeys since 2006
    Kali-Linux - Adding a grenade launcher to the machine guns since 2013

  5. #25
    Join Date
    Jun 2011
    Location
    United Kingdom
    Beans
    Hidden!
    Distro
    Lubuntu Development Release

    Re: Nautilus MASSIVE security fail?

    Quote Originally Posted by haqking View Post
    Wont happen
    Nah, it won't. But it'll make OP feel better and keep the GNOME guys on their toes.

  6. #26
    Join Date
    Aug 2008
    Location
    WA
    Beans
    2,186
    Distro
    Ubuntu

    Re: Nautilus MASSIVE security fail?

    The problem is your subject - it is a fail.

    Folks read this post expecting a "MASSIVE security fail" and instead find nothing of sort - You might have been taken more seriously if you had used accurate subject.

    If this is a "MASSIVE security fail", I'd love see your subject line for a remote root exploit.

Page 3 of 3 FirstFirst 123

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •