Re: [gentoo-user] is the X11 Security extension required for xauth?

[Adam Carter]

-Y still uses an .Xauthority so that isn't a surprise.
> MIT-MAGIC-COOKIE security is used by both -X and -Y, which is what
> this file is used for.
>

> The difference between -X and -Y is in providing a layer of security
> so that remote clients can't play games like keyboard sniffing with
> your local X server.
>

I had conflated those extra checks with .Xauthority.

How would the keyboard sniffing attack work? Since everything over the
network is made confidential by ssh, i'm guessing the attack would be by a
local user on the ssh client/X server box somehow?


Whether this ought to be a default was apparently a debate over a
> decade ago, when the USE flag was at least added to make it possible.
> I haven't used it in a while though so I can't vouch for whether there
> are any issues with -X when the USE flag is enabled to build the
> extension.
>
> https://bugs.gentoo.org/237778
>
>
I can see gentoo disables xcsecurity by default because upstream does.
I'll just stick with -Y then.

thanks