From kde-core-devel Sun Feb 22 16:15:58 2009 From: Michael Pyne Date: Sun, 22 Feb 2009 16:15:58 +0000 To: kde-core-devel Subject: Re: [PATCH] .desktop security ++ Message-Id: <200902221115.58808.mpyne () purinchu ! net> X-MARC-Message: https://marc.info/?l=kde-core-devel&m=123531940822294 MIME-Version: 1 Content-Type: multipart/mixed; boundary="--nextPart1798457.sKXelz3QDg" --nextPart1798457.sKXelz3QDg Content-Type: multipart/alternative; boundary="Boundary-01=_+oXoJleXpaeH4G1" Content-Transfer-Encoding: 7bit --Boundary-01=_+oXoJleXpaeH4G1 Content-Type: text/plain; charset="iso-8859-6" Content-Transfer-Encoding: quoted-printable On Sunday 22 February 2009, Randy Kramer wrote: > What is the security concern that prompts the suggestion to open the > property dialog in the first 10 minutes after creating it? Is it a > concern that some unauthorized person walks up to a PC, installs > something insecure and then proceeds to use it? I just figure that if we're worried about the scenario where someone is=20 tricking into opening a trojan .desktop file, the creation time is the only= =20 bit of meta-data on the file which can't be controlled by the attacker, and= =20 users who have had their own launchers would presumably have taken more tha= n=20 10 minutes to upgrade from 4.2. Just a thought is all. Regards, - Michael Pyne --Boundary-01=_+oXoJleXpaeH4G1 Content-Type: text/html; charset="iso-8859-6" Content-Transfer-Encoding: 7bit On Sunday 22 February 2009, Randy Kramer wrote:
> What is the security concern that prompts the suggestion to open the
> property dialog in the first 10 minutes after creating it? Is it a
> concern that some unauthorized person walks up to a PC, installs
> something insecure and then proceeds to use it?


I just figure that if we're worried about the scenario where someone is tricking into opening a trojan .desktop file, the creation time is the only bit of meta-data on the file which can't be controlled by the attacker, and users who have had their own launchers would presumably have taken more than 10 minutes to upgrade from 4.2. Just a thought is all.


Regards,
- Michael Pyne

--Boundary-01=_+oXoJleXpaeH4G1-- --nextPart1798457.sKXelz3QDg Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEABECAAYFAkmhej4ACgkQqjQYp5Omm0rXaQCgzSqLTTT5kuBftOW0Ea8f01Jl sZQAoKz6azBPUfg8KERsB4dX5nbRDDvx =m2Su -----END PGP SIGNATURE----- --nextPart1798457.sKXelz3QDg--