wayland VS wayland-keylogger

source

Those that have contributed to "http://gitlab.freedesktop.org/wayland/wayland", especially those that are paid by Red Hat to contribute.

"Wayland is a protocol for a compositor to talk to its clients as well as a C library implementation of that protocol" (see https://gitlab.freedesktop.org/wayland/wayland)

https://github.com/wayland-project/wayland Official wayland sources

Intercepting inputs meant for other apps is easy and it's already been done via LD_PRELOAD.

And all of this just for supposedly better "security", that can easily circumvented with trivial attacks.

Not in the same sense that there's a keylogger included with Windows, no. It's that it's easier to do on Xorg as opposed to Wayland. This isn't to say that it's impossible, however.

You can have keylogger on Wayland also without root priviledge. It's trivial: https://github.com/Aishou/wayland-keylogger

> you can still deliver different experiences at runtime — but you’re not likely to have the superuser privileges needed to run a leylogger or read ~/.ssh/id_rsa, etc, at that point.

Keyloggers are trivial to do in userspace Linux via LD_PRELOAD attacks[0], and typically your user account has permission to read ~/.ssh/id_rsa.

[0] https://github.com/Aishou/wayland-keylogger

I have read that bare Linux is totally insecure (https://github.com/Aishou/wayland-keylogger) unless you use some means of sandboxing. That's why I have been reading a lot about firejail, AppArmor, Tomoyo, etc.