Re: Another Mac OS X ScreenSaver Security Issue (after Security Update 2003-07-14)

From: Randy Kaelber (randall_at_nimitz.net)
Date: 08/01/03

  • Next message: Ryan Nelson: "Re: Novell GroupWise 6.5 Clear Text Vulnerability"
    Date: Thu, 31 Jul 2003 23:45:53 -0700
    To: Rizwan Jiwan <Rizwan.Jiwan@KINGSTON.Hummingbird.com>
    
    

    On Thu, Jul 31, 2003 at 01:21:28PM -0400, Rizwan Jiwan wrote:
    > I wouldn't consider this a bug. It is like me writing a script that kills
    > any process named "ScreenSaverEngine". If I run it with my privileges it
    > should allow me to kill the process (assuming I own ScreenSaverEngine).
    > Escape Pod does what it is meant to. OS X does what it is meant to--that is
    > unless you are suggesting that the operating system not allow the user to
    > kill the screen saver process which is just stupid because I have had my
    > screen saver crash on me.

    I agree. It's no more a security hole than having Ctrl-Alt-Backspace
    enabled to kill one's X server when one starts X from the command line
    with "startx" rather than "exec startx". This is a matter of good
    security practice. Relying on a screensaver app to provide you with real
    security is probably not a good security practice. Sticking a Post-it
    note on one's monitor with root password written on it is certainly a bad
    security practice. However, neither of these practices are the fault of
    the software.

    Basing exceptions to rules on the name of the executable running sounds
    like a path towards madness, as well.

    -- 
    Randy Kaelber
    

  • Next message: Ryan Nelson: "Re: Novell GroupWise 6.5 Clear Text Vulnerability"

    Relevant Pages

    • Machine now requires login
      ... sometimes when the screen saver is interrupted, ... Rev. Bob "Bob" Crispen ... bob at crispen dot org ... They say you can kill a man, but you can?t kill an idea. ...
      (microsoft.public.windowsxp.customize)
    • Re: darkening the screen
      ... I created a script that forces the monitor to go to sleep and kill ... >> And nevermind. ... Vbscript definately kicks you out as well now. ... > You can always use the PHM Media Center Screen saver, ...
      (microsoft.public.windows.mediacenter)
    • Kill Remote application
      ... Is there a way in Windows 2003 machine I can kill a remote application? ... Kill a workstation's screen saver with password enabled. ... TIA ... Johnny ...
      (microsoft.public.windows.server.general)