Liskni_si

2007 is when xrandr 1.2 came and made it feasible to use on a laptop - enable/disable outputs dynamically without restarting X.

Xinerama (the extension that enables one virtual screen over multiple outputs) existed before but the layout could only be defined statically - so you'd need to restart your X server with a different config if you wanted to connect a monitor or a projector or something.

> So realistically no application did this.

Old versions of GIMP (back when the toolbars etc. were separate windows) used to let you move any of its windows to a different X screen. And by "move" I don't mean drag - there was a menu where you could select the screen to move to.

I'm somewhat aware of some of this but also... External keyboard only works if you're using the laptop as a desktop computer. It's not really practical if one uses a laptop as a laptop.

And yeah I know there are people lugging a massive mechanical keyboard to cafes but I find that about as annoying as getting used to the ridiculously bad keyboard and no trackpoint of Apple laptops.

Not just hard - impossible. To the point of making it harder to find a job, as very few jobs let you use a non-Windows ThinkPad.

(I mean yeah, of course AuDHD makes it harder to find a job, no surprise there. But it's a shame that laptop manufacturers make it even harder.)

Anyone else still using the 7x13 "misc fixed" font that comes with X11? I just can't switch. Perfectly readable on both 14" 1920×1200 and 35" 3440×1440. Yes it's small but that's kinda the point.

The only issue is that Nerd Font symbols are really hard to read at that size, even if one manages to get them to render (which isn't that hard in alacritty but needs some extra hacks in rxvt-unicode).

What if "the IT department" is just this one guy who asks me to Cc him an invoice when I buy a laptop and that's the end of it?

(yes that's a real story from my career, and the company was 100+ employees at the time)

> But they won't get your private key.

Indeed, that was my point exactly a couple posts up the thread. :-)

> you may realise that something wrong happened

I think I can iterate on the exact mechanics to make this less likely. I mean it's getting off-topic but the one thing that comes to mind is to enable ControlMaster for all ssh connections which allows any second ssh invocation to skip the auth and just re-use the existing connection. ssh-copy-id is near instant then and doesn't ask anything.

At that point you might—rightly so—argue that they're no longer tricking the user into authorising a different operation. Just a reminder that if someone can run code as your local user, they can easily and sneakily gain access elsewhere. Even if you need a yubikey touch to connect there.

The original attack idea of timing the yubikey touch for when you normally expect to touch it might still be relevant for a scenario like ssh-agent forwarding to a malicious box. They can't run code as your local user, but can still perhaps trigger the agent to interact with the yubikey. Maybe.

Okay let me elaborate how I envision that attack to work:

1. attacker wants to use your yubikey-backed ssh key, let's say for running ssh-copy-id once with their own key so they can gain access to your server

2. thus they need to trick you into touching the key when they run that command

3. the best way to trick you is to wait until you do something where you'd normally need to touch that key yourself

4. so they alias ssh to a script that detects when you're trying to connect to this server yourself, and invoke ssh-copy-id instead, which prompts you to touch the yubikey and you do

5. spit out a reasonable looking error (something that makes you think "bloody DNS, it's always DNS, innit" or something silly like that); then they undo the alias so you succeed on the next try and suspect nothing

Perhaps one extra bit to add: you've mentioned consuming slots on the device - that's what happens if you generate a resident key. Those keys live on the device and can be used from any computer you plug them into, without having to retain/copy any files. A non-resident key, on the other hand, is derived from the master key on the device, and a "handle" that's stored as a file on your computer. You can have as many as you want, but if you lose either the file or the hardware device, they're gone.

(Others in the thread have confirmed that both resident and non-resident keys never leave the hardware. If you generate one that requires touch, they're fairly secure - you need physical presence and confirmation for every operation.)

Well I wasn't talking about ssh keys at all - that's where the misunderstanding comes from. I was simply trying to counter your claim that TPMs are never ever useful for individuals. They can be useful to individuals worried about having their boot tampered with.

I absolutely agree that they do zilch to protect your SSH keys. Hardware security keys that need physical confirmation of presence are much better for that use-case.

I don't see how entering a passphrase into a compromised boot loader/kernel/initramfs is as safe as a measured boot with TPM providing the decryption key only if nothing seems to have been tampered with. Can you elaborate please?

I really don't think this is true for FIDO2 like Yubikey. My understanding is that your ssh client gets a challenge from the server, reads the key "handle" from the private key file, and sends both to Yubikey. The device then combines its master key with the handle to get the actual private key, signs the challenge, and gives the result back to your ssh client. At no point does the private key leave the Yubikey.

What am I missing?

Yeah but they already mentioned that they expect the attacker to hijack your ssh command so you'll touch it yourself, thinking you're authorizing something else than you actually are.

It does mean that they can't use the key a thousand times. But once? Yeah sure.

Fair point. Ubuntu 18.04 won't support this. :-)