Aduke.1876 net.followup utcsrgv!utzoo!decvax!duke!bcw Fri Mar 12 19:45:36 1982 Re: Terminal security Subject: Terminal protocol handler Several people have mailed some objections to the terminal protocol handler mentioned in my last submission as a method for ensuring terminal security. It appears there may be some interest in this subject for the network. The major objection is that legitimate uses of sequences like "send screen" or "Program function key" or the like are voided by this scheme. This is true on a simpleminded implementation of the handler but there are workarounds: 1) It would of course be possible to simply ignore the problem because these functions are relatively infrequently used. 2) It is also possible to allow a mode (similar to raw mode for the current terminal driver) which allows such things to be transferred. For normal writes, the offending sequences would be edited out as before; moreover, only the user of the terminal would be able to set the terminal into this mode. It is likely that for security reasons this should be implemented as an alternate version of write rather than as a true mode a la raw mode. The second implementation would allow these things to be used as desired, although with a slight amount of additional work on the part of the programmer. Note that there would still be possibilities of subversion by running a program belonging to another user which, since it is running in your context, would have full access to your screen; but this is really no worse than the security problems which currently exist with running other people's programs. It's true that this would be a certain amount of work (after all, it's necessary in this scheme to be aware of what editing that this handler applies to the output stream if you're trying to use these features), but it looks to me as if it *does* ensure security, at a very moderate cost in convenience. Bruce C. Wright @ Duke University ----------------------------------------------------------------- gopher://quux.org/ conversion by John Goerzen of http://communication.ucsd.edu/A-News/ This Usenet Oldnews Archive article may be copied and distributed freely, provided: 1. There is no money collected for the text(s) of the articles. 2. The following notice remains appended to each copy: The Usenet Oldnews Archive: Compilation Copyright (C) 1981, 1996 Bruce Jones, Henry Spencer, David Wiseman.