Hacker News Reader

Comment by 08-15 | Hacker News Reader

Care to explain? I mean, in principle. I distrust Signal Desktop, whether it's built on Chrome or on Electron, because either of those "platforms" are more complex than my OS (Debian GNU/Linux). But you seem to be making a more general point... what's the reasoning?

View on HN

No matter what Signal does with Desktop, it will remain a standard desktop application, meaning it will in general be as secure as the least secure application sharing that desktop.

If all your software comes from the App Store and is properly sandboxed, it's possible for this to approach the security of iOS. Of course, many people will install unsandboxed software, making this extremely difficult to actually achieve, but it's at least possible.

What's a desktop and what does it mean to share it?

My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other. (Are you referring to MicroSoft Windows[TM] by any chance? Yeah, that's different.)

What are you using for X security context isolation? I've been wanting a good solution for that one for a while now, and the end of my list is still “write my own isolating proxy” since I never found a good one.

See: https://www.qubes-os.org/doc/gui/

(they have essentially written 2500 lines of c that acts as a proxy of sorts)

Nothing... but can X11 applications actually steal data from each other? I wouldn't know how to do that, but I know precious little about the X11 protocol. (Screen shots are an awkward option, I guess.)

If I was worried enough (I'm not), I could use multiple logins. Two different X servers under different users would be completely isolated.

Even using two X servers under two logins, the fact is that desktop apps by default have much more freedom and therefore much more surface to attack. Even the kernel syscalls alone are not safe; exploits that elevate processes to root are not rare. You'd need to lock them down much more than just using different users.

By the way, they may have an history, but nowadays I wouldn't bet on the security of the average distro vs Windows, and I say this as a dyed-in-the-wool Debian user. For example, their Desktop environment does have protections against cross-application attacks, unlike X.

> My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other.

You are probably mistaken.

https://github.com/esonn/x11log

http://blog.martin-graesslin.com/blog/2015/01/why-screen-loc...

You might want to look at qubesos :

https://www.qubes-os.org/doc/gui/

I dunno if it's still true, but it used to be that every process running in your X11 window had access to every keystroke from every other application. Like, say, every password you type into a terminal window or browser... If it _is_ still true (and I've noticed a bit of recent discussion asking why Ubuntu 18LTS is switching back from Wayland to X11 which hints to me that it might be), then your apps are _very_ much not "pretty well isolated"...

Is there currently any desktop application delivery/sandboxing mechanism that has any hope of changing this situation in the future?

Wayland, the xdg-apps sandboxing (now FlatPak), containers in general, etc.

Something like Qubes is the only way we'll ever get decent security on the desktop, I'd say.

Reply on news.ycombinator.com