LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Ubuntu
User Name
Password
Ubuntu This forum is for the discussion of Ubuntu Linux.

Notices


Reply
  Search this Thread
Old 06-08-2012, 07:54 AM   #1
taylorkh
Senior Member
 
Registered: Jul 2006
Location: North Carolina
Distribution: CentOS 6, CentOS 7 (with Mate), Ubuntu 16.04 Mate
Posts: 2,127

Rep: Reputation: 174Reputation: 174
12.04 security weakness (or at least could be darned embarrassing)


I finally threw in the towel and installed 12.04 with gnome-session-fallback on my netbook. I got almost everything tweaked to my liking and finally I added a picture as the desktop background instead of the garish colors provided by Canonical. To my surprise I found that my desktop background had become the the login background.

I then built a 12.04 virtual machine in VMWare. I created three stooges (users) Moe, Larry and Curly. I assigned each a different desktop background image. At the login screen I find that by selecting the username I see that user's desktop.

Putting on my paranoid hat (from working for 18 years in IT for a Fortune 500 company) I see the the following concerns:

1 - by providing a list of user accounts Ubuntu has already given away half of the credential data

2- by showing the user's chosen desktop it may have given a hint to the user's password. For example if the user has a picture of their dog as their desktop background and their co-workers know that their dog is named Rover then how about Rover01 Rover2012 R0ver etc. ? I have seen worse.

Finally, if the boss uses a revealing picture of his hot wife

It just strikes me that Canonical is making Ubuntu less corporate friendly to be more user friendly. I wonder if this is self defeating as their income is from corporate customers not individual uses?

Ken
 
Old 06-08-2012, 08:01 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
I think point 2 is pretty baseless. That's the users problem, in the same way that I also found that 12.04 also does nothing whatsoever to prevent the user writing their password on a post-it note and sticking it to their monitor.

Does seems like an odd behavior though, unless the view is that it's so likely to be a single user system it just makes the user experience nicer at no cost? Don't like the sound of that certainly, unless his wife is fit. But then again, it's basically a logical extension of the avatar style image that Win7 uses for one thing.
 
Old 06-08-2012, 08:26 AM   #3
taylorkh
Senior Member
 
Registered: Jul 2006
Location: North Carolina
Distribution: CentOS 6, CentOS 7 (with Mate), Ubuntu 16.04 Mate
Posts: 2,127

Original Poster
Rep: Reputation: 174Reputation: 174
Thanks Chris,

I guess it might be a stretch. I never did like the avatar, pick the user approach from Microsoft. I do not like the similar approach in Ubuntu 12.04 and am frustrated in being unable to find a way to return to the simple greeter available in 10.04. Thus my rant...

Ken

p.s. And I am frustrated at being unable to thoroughly test 'buntu interfaces on VMWare before committing to installing on on actual hardware. Ubuntu with gnome-session-fallback is flaky. Mint 13 Cinnamon is very different on VMWare vs. hardware. Lubuntu has similar differences and flakyness.

Last edited by taylorkh; 06-08-2012 at 08:29 AM.
 
Old 06-08-2012, 08:51 AM   #4
snowday
Senior Member
 
Registered: Feb 2009
Posts: 4,667

Rep: Reputation: 1411Reputation: 1411Reputation: 1411Reputation: 1411Reputation: 1411Reputation: 1411Reputation: 1411Reputation: 1411Reputation: 1411Reputation: 1411
It gets worse... my experience with Ubuntu 12.04 is that, when waking from suspend or screen-lock, when you are prompted for the password, artifacts from the session are clearly visible on the screen!

Thus if you walk away from your desk and suspend the machine, anyone can walk by, jiggle the mouse, and potentially see what you are working on.
 
Old 06-08-2012, 09:10 AM   #5
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
Heh, my version was that the screen would not lock **until** you moved the mouse! read but don't touch! useful!
 
Old 06-08-2012, 10:35 AM   #6
taylorkh
Senior Member
 
Registered: Jul 2006
Location: North Carolina
Distribution: CentOS 6, CentOS 7 (with Mate), Ubuntu 16.04 Mate
Posts: 2,127

Original Poster
Rep: Reputation: 174Reputation: 174
I have noticed that with 10.04 as well. Especially when connected remotely.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
OpenVZ: HOWto Communicate between VE's without creating a security weakness? WildDrake! Linux - Security 5 11-26-2011 09:06 AM
Facebook fixes embarrassing security flaw Jeebizz Linux - News 0 05-05-2010 12:46 PM
wterm and that darned beep... rose_bud4201 Linux - Software 2 05-28-2004 11:42 PM
Mplayer and its darned gui Ogledbyoldmen Linux - Software 17 11-22-2003 11:52 AM
darned debian....giving me problems. kmistry Linux - General 3 09-29-2002 09:56 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Ubuntu

All times are GMT -5. The time now is 10:34 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration