[server] Minimum supported idle timeout is 5 sec
Review Request #126220 - Created Dec. 2, 2015 and submitted
A system isn't idle by definition below 5 sec. Before it's not possible to properly determine whether the user is still interacting with the system or not. Thus such a short timeout is not sufficient to determine whether the system is idle. Furthermore allowing short timeouts like 1 msec can be used to gather information from the system. It would allow to reconstruct the timestamp changes on the seat very reliable, which we do not want a Client to know. And also this can be used to get events on each key press and key release and the time between each of the events. This can be used to gather statistics which would in worst case allow to reconstruct what the user is typing. Determining where a word starts and ends should be relatively straight forward if you know the timing. With the length of the word and the statistics of alphabetic distribution it becomes possible to reconstruct some words. And also individual letters. With enough statistic and some known words one can determine how long it takes to press a certain letter. At that point the idle interface would be a keylogger. To prevent such attacks the timestamp is now modified to be at least 5 sec. Why 5 sec? Because it's the smallest timestamp used in the KIdleTime example application which I do not want to break. 5 sec are long enough to destroy this possible attack.