For years I've been aware of screensaver bugs on some 3rd-party Android ROMs such that the screenlock can reveal the desktop (wallpapers, possibly with some app icons) even if the user doesn't mean to unlock the device. I don't know about solutions other than using another ROM. However, recently I learned that such horrible bug not only happens on mobile devices but also on PCs. It was the compiz window manager on a Linux box. When you lock the screen and press any key, it seems that you can only reshow your desktop by entering the correct password. But this is not true. I simply plugged my Android device to the USB port and guess what? My desktop was shown with currently running programs on the task bar. This might be due to some background services being activated from a hardware event. But for whatever reason this was definitely not what I wanted so I finally said goodbye to compiz.

I'm still wondering why, given the importance of a screensaver/screenlock program, such a bug is still possible. Is the screensaver only running as a normal process intercepting key/mouse events, but with the same privileges as other applications? Is the security of a screensaver solely based on careful programming? What kind of support the OS can provide to make sure the screen is unlocked only when the user really means to do so and has provided proper credentials?

  • Today most screensavers are a window pinned at top and capturing all input events. Under linux especially gnome-screensaver had its serious bugs, while xscreensaver sacrifices some user convenience (i.e. the toolkit theme) to provide more security (less components which may contain bugs). A secure system would integrate this in the display-architecture. I.e. wayland under linux will provide more secure screen locking. – allo Aug 29 '18 at 13:29
  • @allo I think the OS or the display system definitely need to do something here. Using a normal window intercepting input events looks flaky. In this case I guess either the window manager or the screensaver doesn't think about other types of events that may possibly unlock the screen. Ironically I was on wayland... But I think it's very likely compiz fault in this case. – Cyker Aug 29 '18 at 13:34
  • @allo My understanding is that, the screensaver is above the window manager, which is above the display system, which is above the OS kernel. There should be support from the lower-level components giving the screensaver more control about the display. Relying on correct programming of upper-level applications is deemed too risky. – Cyker Aug 29 '18 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.