A huge security flaw in KDE/Kubuntu!

[Telengard]

Re: A huge security flaw in KDE/Kubuntu!

Well, maybe the thread title is a bit overstated, but some people lock their desktop for a reason. And what's the point of locking it if it doesn't work?

Your OP left me (and others apparently) thinking that the screen saver did not work correctly. If locking the session (CTRL+ALT+L) does nothing, then that would probably qualify as a bug. In that case you should probably file a bug report on launchpad. In the meantime, you should pursue some of the workarounds already suggested in this thread.

It would help a lot if someone here could duplicate the misbehavior you're experiencing. I'll try to duplicate it, but I'd like to know more about your screen saver settings (e.g. did you install a custom screen saver?) Can anyone else try this?

[Tynach]

Re: A huge security flaw in KDE/Kubuntu!

I lock frequently, and the MOST I get is a brief flash of the desktop, but so quick I'm not sure I saw it. And that's if I have no screensaver selected.

What graphics card do you have, viking_maniac?

[Telengard]

Re: A huge security flaw in KDE/Kubuntu!

While either locking the screen/session, or switching between the accounts, normally you should see a completely black screen with only the password prompt window in the middle. This I remember from Gnome/Ubuntu.

In KDE/Kubuntu, sometimes a bug hits the system so the screen of the session that you're about to log back into reveals the whole desktop in the background, and some corrupt graphics is shown around the login and password field. There's no problem logging back in again, but man, anyone can just give that a try, and even without a password, they'll get a perfect glance of the active desktop while the password is being prompted; this could reveal every open document on that desktop.

Sorry but I can't duplicate the behavior you describe. I am using Karmic's default blank screen screen saver. In my attempts, the screen goes completely black when locked, and no part of the locked desktop appears until after the user name and password is entered. I even tried entering a wrong password to see if it would glitch, but the screen remained completely black besides the authentication dialog.

Can you provide detailed steps to reproduce the misbehavior? If we can consistently reproduce it then we have a legitimate bug.