Usually I only install open source programs on my linux box because I don't trust closed source applications. Recently I had to use Dropbox for a university project. I created a separate linux account named work and run (as work)  dropbox without installation via a python script. The script also created a symbol in the system tray that provides a GUI for some of Dropbox's functions.The other day I had to do some maintenance so I opened a virtual terminal (konsole on KDE) and entered my root password for su.Is there a chance the Dropbox application could have captured my root password?I use Fedora 20 with KDE 4.14.3.
Can another program on X capture my root password while I type it in a virtual terminal?
security;x11;xorg;keyboard
Short answer: Yes.In the olden days, it was possible to effectively prevent any other X application from reading a specific input by grabbing it. While this can still be done to this day, the XI2 protocol specification seems to suggest that this can't be done any more (see the description of Raw Events around line 2220). Thus under X alone you are not safe any more - at least not in the usual simple setups. See also the discussion under my answer to How to let a daemon prompt for a password (in Xsession, keyloggersafe)? and the AskUbuntu Q&A referenced there. Needless to say, no terminals are actually doing that - which is why applications like OpenSSH or GnuPG come with their own UI helpers, that grab keyboard (although as mentioned above, it doesn't really help that much these days).What you could do though would be running an application under a different X server, e.g. a nested X server like Xephyr or Xnest, or VNC based one like Xvnc. Wayland protocol should also provide some protection against eavesdropping.Apart from the above, the application could have also tried to exploit an unpatched security hole in your system and thus gain elevated privileges. Or do something easier, like putting a su and sudo wrappers into your path before the system ones and thus intercepting the passwords (thanks @Joshua for the comment).