<html><head></head><body>Ha! Nessie sighting indeed!<br><br>GDM doesn't directly handle login. It calls a library, draws a box, and the box content is owned by the library call. The login security is perhaps the only secure thing in X.<br><br>Yeah. Nessie was spotted. Say 'HI' for us all. :-)<br><br><div class="gmail_quote">On December 12, 2018 9:16:28 AM EST, Todor Fassl <fassl.tod@gmail.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Correction: This was on a machine using gdm as the display manager.<br><br>Yeah, my take was the humans make patterns out of everything thing. He <br>said it flashed on the screen for half a second.<br><br>Even to keep multiple user passwords in memory, much less to display <br>them, would be a huge security flaw. Why would any display manager do <br>that? The password has no use once the user has been authenticated. It <br>doesn't seem likely to me that a bug like this could evenexist in gdm.<br><br>I have already told my manager that I believe this is a Loch Ness <br>Monster sighting. But I thought I would see what you folks said.<br><br>On 12/11/18 4:01 PM, Jim Kinney wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">I've seen screen flashes of text but it's always been random library <br>code stuff and gdm errors. I've not used lightdm before. Bluntly, the <br>system should never be storing passwords in plain text using any method. <br>It's supposed to be flushed out or overwritten immediately when the user <br>entry is converted to salted:sha256 format. But this is more of why X is <br>notoriously insecure.<br><br>It could also be a random thing that a user "saw" their password in that <br>half second and really perceived it as their password when it was really <br>just crap. Humans make patterns out of everything.<br><br>If someone has a camera with slow motion ability, have multiple people <br>log in then lock the screen and video the "sign in as another user" <br>process in slow motion. If the others see their password in the video, <br>notify Ubuntu and lightdm developers.<br><br>On Tue, 2018-12-11 at 15:02 -0600, Todor Fassl via Ale wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> What do you all make of this report from an end user? The user is a grad<br> student who shares an office with several other students. Right now,<br> there are 5 of them logged in, they've all failed to log out when they<br> walked away from the machine.<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;">I was about to use the machine in my [shared] office just now, and had<br>to click "sign in as another user". In between that and the list of<br>usernames appearing, a black screen with white text on it popped up<br>for half a second tops. I noticed it showed my password in plain text,<br>and presumably some of the other text was other people's passwords.<br></blockquote><br> The system is a fully updated ubuntu bionic system using lightdm for the<br> display manager.<br><br></blockquote>-- <br><br>James P. Kinney III<br><br>Every time you stop a school, you will have to build a jail. What you<br>gain at one end you lose at the other. It's like feeding a dog on his<br>own tail. It won't fatten the dog.<br>- Speech 11/23/1900 Mark Twain<br><br><a href="http://heretothereideas.blogspot.com/">http://heretothereideas.blogspot.com/</a><br><br></blockquote></pre></blockquote></div><br>-- <br>Sent from my Android device with K-9 Mail. All tyopes are thumb related and reflect authenticity.</body></html>