Re: SSH revised

[Bas Wijnen]

On Tue, Mar 28, 2006 at 06:49:34PM +0200, Marcus Brinkmann wrote:
> At Tue, 28 Mar 2006 12:19:15 +0200,
> Bas Wijnen <address@hidden> wrote:
> > Are you watching movies within the login manager?  I would really suggest to
> > not make that thing any more complicated than necessary, and including a
> > movie player seems like a significant complication. ;-)
> 
> If you use a graphical border to indicate system state, you must never
> release this screen space for other uses.

Correct.

> Otherwise a malicious user could just display a green border and lure people
> into entering the password.

Indeed.

> If your response is that the user is required to press the terminal
> reset escape sequence, then the border color seems to serve no purpose.

However, all this is only true within the login manager.  You must press
system request to enter that.  However, while the login manager is running,
you would need to press system request again each time a user-provided program
finishes running.  This proposal solves that.  It does not "solve" the problem
that you need to press system request to enter the login manager.

For this, it is important that the user knows when the login manager is in
control and when it isn't.  In particular, the screen is no longer "safe"
after a login attempt (succesful or not), and after pressing the "full screen"
button.

In general, if the user doesn't know the state of the system, she should press
system request.  But without this border, that would also be needed when the
user thinks she does know the state, because she can never be sure in that
case.

Thanks,
Bas

-- 
I encourage people to send encrypted e-mail (see http://www.gnupg.org).
If you have problems reading my e-mail, use a better reader.
Please send the central message of e-mails as plain text
   in the message body, not as HTML and definitely not as MS Word.
Please do not use the MS Word format for attachments either.
For more information, see http://129.125.47.90/e-mail.html

signature.asc
Description: Digital signature