This is a discussion on Re: X11 exploit info - KDE ; Ok well apart from the fact that this is about an article from 2004 about something that isn't enabled by default and is nothing to do with KDE dev... > > 1. You've given permission by explicitly enabling the "-X" ...
Ok well apart from the fact that this is about an article from 2004 about
something that isn't enabled by default and is nothing to do with KDE
> > 1. You've given permission by explicitly enabling the "-X" option.
> I may have given him permission by the "-X" but that's not what
> I intended to do. I just wanted to have windows open locally.
No you've explicitly made a machine to machine tunnel through all these
firewalls you're talking about AND then said and now please forward X
traffiic between these machines too.
You shouldn't be doing either of those steps against a machine you don't
> People should be informed that they shouldn't do that.
> I didn't at some point. The way it works is all very logical if you think
> about it, but what about those who don't ... it's not that obvious.
It's off by default. You have to explicitly turn it on. The idea that people
will be ssh'd into a remote box with X forwarding and doing their home
banking is absurd.
> Of course everything that happens on the remote machine is under his
> control. Sniffing data and passwords that get to the remote machine in
> clear text form.
> But how would that compromise my local machine and
> It's *my* version of the ssh client that's used and that one won't log
> keystrokes and send them to Joe Hacker.
No. If the remote machine is compromised then potentially the remote sshd is
compromised too. That's not just *your* version of the ssh client that's
used, anything your ssh client sends to the remote server is available
unencrypted. Not only that but if you're ssh'd into the remote machine then
no doubt you're going to be running programs there too? after all, why else
would you be X forwarding? and any of those programs could be compromised.
The X traffic is the least of your worries.
>> Visit http://mail.kde.org/mailman/listinfo/kde-devel#unsub to unsubscribe <<