Recent Features
| |||||||||||||
The no encyption caveat?The no encyption caveat?Posted Jul 30, 2009 11:24 UTC (Thu) by alex (subscriber, #1355)Parent article: A desktop "secrets" API
Is that possible, surely on a multi-user system you don't want people listening to the dbus connection and sniffing your secrets? I assume this information is going across the session bus rather than the system bus but it presents a very tempting attack target.
I take the point that any client storing secrets that can't lock pages in RAM is also exploitable but how about some sort of defense in depth?
(Log in to post comments)
The no encyption caveat? Posted Jul 30, 2009 19:17 UTC (Thu) by rvfh (subscriber, #31018) [Link]
I think that it's called dbus by analogy with hardware buses, but it's probably just a bunch of shared memory, so there is in fact no bus to sniff, unless you have the right permissions (which I expect to be kinda -rw-------).
Correct me if I'm mistaken... which I might well be!
|
|||||||||||||