Qubes R4.3 is using xfce4-screensaver for screen locker. I don’t trust DE to deliver a secure screenlocker. What alternatives are other people using? Meanwhile I will install xscreensaver again, tho it’s not ideal either
Uh, qubes used to have it’s own screen locker, the fact that they changed it must mean that the standard one is pretty good, why would they downgrade otherwise
In the other hand this is an advise I got from a friend of mine a year back:
find any old flash drive, encrypt it and store a hash or something in it, have sys-usb auto connect that USB to a sys-unlock, create an entry to /etc/mounts and crypttab to auto unlock that usb and send the hash to dom0 every second or so, then create a Pam file to check delivered hashes from sys-unlock and it it matches then enable no password unlock for the user and disable that Pam setting after a second, lastly disable password unlock completely
Its not xfce lock screen that is insecure, its where in memory does Linux store xfce-lockscreen and if there is a way for someone to manipulate that, but yet AGAIN Pam does the unlocking
Nevertheless the Pam USB key trick shouldn’t take more then a couple hours to setup and an hour or two more to make sure it is hardened enough, even with an AI’s help I mean