| From | Wolfram Gloger <> | Subject | Re: [ 03/42] TTY: fix atime/mtime regression | Date | Tue, 30 Apr 2013 14:02:16 +0200 |
| |
Hi,
>To revert to the old behaviour while still preventing attackers to >guess the password length, we update the timestamps in one-minute >intervals by this patch.
Sorry if I miss something, but isn't this an issue that should be very obviously fixed in user space? Only user space knows whether the atime/mtime updates on a device are security-sensitive or not.
The sshd process and/or the login process could easily perform randomly timed, dummy utime() calls on the tty around and within the password typing, making this attack unfeasible. I faintly remember sshd _already does this_ for the network packets anyway by exchanging dummy packets.
Regards, Wolfram.
|