<html>
<body>
<div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
<table bgcolor="#f9f3c9" width="100%" cellpadding="12" style="border: 1px #c9c399 solid; border-radius: 6px; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tr>
<td>
This is an automatically generated e-mail. To reply, visit:
<a href="https://git.reviewboard.kde.org/r/126220/">https://git.reviewboard.kde.org/r/126220/</a>
</td>
</tr>
</table>
<br />
<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="12" style="border: 1px #888a85 solid; border-radius: 6px; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tr>
<td>
<div>Review request for Plasma and Sebastian Kügler.</div>
<div>By Martin Gräßlin.</div>
<div style="margin-top: 1.5em;">
<b style="color: #575012; font-size: 10pt;">Repository: </b>
kwayland
</div>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">A system isn't idle by definition below 5 sec. Before it's not possible
to properly determine whether the user is still interacting with the
system or not. Thus such a short timeout is not sufficient to determine
whether the system is idle.
Furthermore allowing short timeouts like 1 msec can be used to gather
information from the system. It would allow to reconstruct the timestamp
changes on the seat very reliable, which we do not want a Client to know.
And also this can be used to get events on each key press and key release
and the time between each of the events. This can be used to gather
statistics which would in worst case allow to reconstruct what the user
is typing. Determining where a word starts and ends should be relatively
straight forward if you know the timing. With the length of the word and
the statistics of alphabetic distribution it becomes possible to
reconstruct some words. And also individual letters. With enough
statistic and some known words one can determine how long it takes to
press a certain letter. At that point the idle interface would be a
keylogger.
To prevent such attacks the timestamp is now modified to be at least
5 sec. Why 5 sec? Because it's the smallest timestamp used in the
KIdleTime example application which I do not want to break.
5 sec are long enough to destroy this possible attack.</pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> </h1>
<ul style="margin-left: 3em; padding-left: 0;">
<li>src/server/idle_interface.cpp <span style="color: grey">(90d7324ac415a2293e4e508605e0fb4aafdf1b82)</span></li>
</ul>
<p><a href="https://git.reviewboard.kde.org/r/126220/diff/" style="margin-left: 3em;">View Diff</a></p>
</td>
</tr>
</table>
</div>
</body>
</html>