108967 - Mouse movements shouldn't be the only source of entropy

Status: RESOLVED WONTFIX

(Core Graveyard :: Security: UI, defect, P2)

Description

[Kai Engert [:KaiE:]]

I just read bug 57985.

I think there are systems on the market that don't use a mouse. You can control
windows completely without using the mouse. There are systems that use a
touchscreen, without generating mouse movement events.

If mouse movements are currently the only source of entropy collection, is it
worth to add another source, maybe the keys pressed by the user?

Comment 1

[Stephane Saux]

kaie

Comment 2

[Kai Engert [:KaiE:]]

What is your opinion regarding this bug?

Comment 3

[Stephane Saux]

Nelson should give his opinion.

Comment 4

[John Unruh]

nsbeta1

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

I believe that PSM should take entropy from anywhere it can get it.
Keystroke values, and (more importanly) the value of a high-precision
timestamp associated with each key press, if available, make good 
additional sources of entropy.  I think it would be good to get that
data, if available.

But as shown in http://bugzilla.mozilla.org/show_bug.cgi?id=57985 
there are many in the mozilla team who are paralyzed with fear over 
the cost of collecting entropy data.  I predict that any attempt
to collect more entropy than is already collected will meet with
much resistance from mozilla engineers.  

Comment 6

[Daniel Jensen]

I'm quite possibly wrong, but I see this bug as asking not for more entropy or
less entropy but for some entropy. However, since mouse usage isn't the only
entropy source after all, it seems to me that this bug's concern is that the
overall "available entropy" for PSM should, in a perfect world, be independent
of whether or not you have a mouse. (Unfortunately, we don't live in a perfect
world and enough people have mice that this isn't exacly 1st on the radar.)
Overall, this bug doesn't need to depend on the discussion over at 57985.

Comment 7

[Kai Engert [:KaiE:]]

changing obsolete psm* target to --- (unspecified)

Comment 8

[Kai Engert [:KaiE:]]

This bug might become more important as touchscreen system are becoming more widespread.

Comment 9

[Dana Keeler (she/her) [:keeler]]

Entropy comes from the OS now.