Security Implications: Use cases

Security Implications: Use cases

Posted Nov 9, 2007 18:19 UTC (Fri) by AnswerGuy (guest, #1256)
In reply to: Memory management for graphics processors by jwb
Parent article: Memory management for graphics processors

The "fast user switching" feature that's being added to systems like Ubuntu might have some security downsides. However, we should consider the use case for which "fast user switching" is intended an keep in mind that there are other user switching methods available.

Perusing the Wikipedia article on fast user switching will cover some of the security considerations. Since the "virtual console" features of Linux, FreeBSD and other PC UNIX clones fit roughly into the category of "fast user switching" then the fact that the contents of all those additional terminal (text) screens is visible is roughly the same risk as you express concern about.

The obvious suggestions are: employ screen blankers which are (optionally) hooked into the fast user switching, don't use fast user switching in security sensitive situations (such as Internet cafes).

This latter point is the most obvious. In any case where you're worried about the next user potentially trying to snoop or exploit your session you should be using a "secure attention key" to force the system to kill all processes associated with your terminal and revoke all credentials from it.

Clearly the intended use cases for "fast user switching" are the common situations where folks want to share a computer while maintaining their own desktop configurations, etc. For example I have a couple of computers in the living room, one at the end of the couch and another by the easy chair. Everyone in the household uses whichever of these is closest to do a little web browsing, re-attach to his or her screen session, read e-mail or whatever. Since my wife and I both have root on all of machines around the house we're clearly not worried about the other being able to bypass security, etc.

Given that "fast user switching" implies console access ... there are far greater security risk associated with PC console access in general.

JimD

---

(Log in to post comments)