The connection column indicates the connection used. USB FS stands for the usb full speed protocol, which allows up to 1000Hz polling, a feature commonly advertised by high-end keyboards. USB is the usb low speed protocol, which is the protocol most keyboards use.

USB Low Speed allows 1kHz polling too. I don’t think you gain anything at all from High Speed. Keyboards probably only use it incidentally because the chip they are using happens to support it anyway.

Huh I was under the impression that you could limit it to specific applications and dbus would tell kwallet the path of the application making the request (which could be done at least vaguely securely). But upon further investigation it just uses the “appid” that the app reports which it can apparently set to anything it wants. It’s difficult to find information about this stuff though. D-bus is not very well documented at all.

Interesting how do you do that exactly?

I was thinking you can just start the app that has permission to read the wallet, attach a debugger and then inject code to dump the wallet. It’s definitely more complicated than reading a plain text file but not fundamentally less possible.

But really if you have that level of access it’s game over anyway and you just MitM sudo and get root access, or use one of the many local privilege escalation vulnerabilities and get root immediately.

They should be keeping them in something like kwallet. But in practice they don’t because a) there isn’t really a single standard for that on Linux (yeay, I have to support gnome-keyring too!), b) it’s a lot more work than using a plain text file, c) the UX is considerably worse, and d) the security benefits are marginal at best (especially if you have full disk encryption).

Plain text is the most sensible option.