gnome-screensaver exposes sensitive data

[willdeans]

People depend heavily on the lock screen (rightfully or wrongfully) to prevent others from seeing sensitive data. gnome-screensaver can easily expose this sensitive data.

Example:

During day:
1. Network boot Ubuntu into GUI
2. Open sensitive document
3. CTRL-ALT-F[1-6] and use a TTY
4. Logout of TTY and attend meeting
5. Go home an hour later

At this point a user has a reasonable expectation of his or her sensitive document being secure believing a password (or physical access to server) will be needed to see the sensitive information.

At night:
6. Record screen with mobile
7. CTRL-ALT-F7 (the document will briefly be displayed before the lock screen)
8. CTRL-ALT-F[1-6] back to the original TTY to hide your tracks
9. Go frame by frame through the video to retrieve the sensitive information

I wouldn't call this an enhancement because I spoke to several users and ALL of them had the expectation their data would not be visible. People were especially sensitive to the reading of private chat sessions. Users didn't expect just anyone could go from cubical to cubical at night secretly exposing screens. Whenever a user has a screen lock the locking application needs to ensure contents of the screen won't be visible after the lockout time. If it is really so hard to clear the contents of the screen then turn off output of the video card when the user hits CTRL-ALT-F7 until the sensitive data is gone.

cat /etc/issue
Ubuntu 12.04.2 LTS \n \l

Package: gnome-screensaver
Priority: optional
Section: gnome
Installed-Size: 412
Maintainer: Ubuntu Desktop Team <email address hidden>
Original-Maintainer: Guilherme de S. Pastore <email address hidden>
Architecture: amd64
Version: 3.4.1-0ubuntu1

Priority: optional
Section: universe/gnome
Installed-Size: 51
Maintainer: Ubuntu Developers <email address hidden>
Original-Maintainer: Debian GNOME Maintainers <email address hidden>
Architecture: amd64
Source: meta-gnome3
Version: 1:3.0+6ubuntu3

[Seth Arnold (seth-arnold)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. This particular bug has already been reported and is a duplicate of bug 49579, so it is being marked as such.

This is a fundamental bug in the design of X11 and cannot be easily fixed within X11.

You should manually lock your screen if a locked session is important to you.

Please continue to report any other bugs you may find.