Hacker News Reader

Comment by grenoire | Hacker News Reader

I thought the rule was: If you can see it plaintext on the screen, it's not safe.

Could you elaborate on that? Of course no computer is completely secure against all forms of attack, but I’ve found statements like these to not contribute very much towards solving any practical security problems.

The moment that a string of text appears on your screen, it is passed through between many different functions (and even pieces of hardware, with textures being stored on the GPU VRAM) and has unencrypted copies laying all around in memory as the application is running.

Any part of the space in which these copies exist being compromised will mean that your encryption is useless in the end.

You have to draw the line somewhere. Otherwise we'd be saying that HTTPS/TLS is not secure since the webpage is rendered to your monitor unencrypted.

I agree with the parent quote:

> I’ve found statements like these to not contribute very much towards solving any practical security problems.

But HTTP/TLS indeed is not secure from the point of your local machine. Its entire point is protection of data in transit.

On windows any program can read the contents of any window on the current desktop (with some exceptions, like UAC prompts and other windows that dim your entire screen). This has legimate use cases for screen readers or dictation, but of course it can also be abused. Same for X11. On more modern operating systems like Android the user needs to take very explicit action to allow an app to do that.

Wow, I had no idea this was also the case on Windows! I was aware of this on X11 and switched to a Wayland compositor as a result. Is this true for macOS? I know for sure that on more recent versions of macOS, applications which want to capture the entire screen require special user-approved permissions, but can they selectively read other windows?

Reply on news.ycombinator.com