I noticed that, when I go to TTY3 (by typing CTRL+ALT+3), bucklespring stops working, and when I go out to the GUI it works again. Also, when I run xinput test-xi2 on TTY3, it tells me 'Unable to connect to X server'. Running just xinput results in the same. I also tried: running xinput test-xi2 in the GUI, switching to TTY3, pressing 'l' (keycode 46) many times, returning to the GUI, and searching for '46' in the xinput test-xi2 output (I used Tmux to search). I couldn't find any mention of keycode 46.

This means that a Keylogger does not works in TTY3?

I know that there are keyloggers that runs a kernel level or have root privileges. In these cases, there are nothing to do. I am asking about keyloggers that runs at user level, out of 'input' group, so no access to '/dev/input/'.

I want to know if is more secure to use sudo in TTY3 instead of in a terminal emulator.

  • 2
    More secure compared to? Who are you defending against? What is the threat model? If somebody can arbitrary programs as your user, they could edit your bashrc and create a sudo wrapper function that logs your password
    – muru
    Commented May 23 at 2:48
  • I was thinking about a keylogger application running in a normal user (lets name it 'local_user') without 'sudo'. And have a administrator user (lets name it 'admin') with 'sudo' access. I was thinking about it because there are some packages that I use that are installed only to local user (example: PyPI packages), and I don't want them in the 'admin' user. The 'admin' can have only the default configuration that Ubuntu does when creating a user. So, when I want to do some modification in the system, I go to TTY3 and log in the 'admin' to do the root stuff. Commented May 23 at 15:54
  • @muru More secure compared to?: Compared to use with a terminal emulator in GUI. Who are you defending against? A generic keylogger like github.com/kernc/logkeys What is the threat model? I keylogger that runs when starting the user. Example, if it adds a line in '.profile' to autostart. (its is an example, I doesn't now much about keyloggers). Thanks by the 'sudo wrapper example'. I didn't think about it. Commented May 23 at 16:00

1 Answer 1


When you switch to a text terminal, the input path goes directly from the keyboard to the virtual console driver, and to the application as characters.

When you are in the GUI, the kernel keyboard driver is in a different mode and the input goes through the X11 server as key codes, through its input processing which includes the XInput extension, to the graphical terminal emulator application, translated to characters, and then to the application running in the terminal.

Also, in X11, any application can listen to keystrokes, not just the one getting focus. Wayland fixes this.

It's not that "tty3" is more secure so much as the input path is just totally different, and doesn't get near the GUI input path. Although it is harder to undetectably snoop on a direct text terminal than a GUI terminal, at least, without kernel modifications.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .