Xauth
X11's way of deciding who may draw on a display: a secret cookie in a file, sent in plain text.
The original access control in X was xhost, which let entire machines in or kept them out. Every user on an allowed host therefore had access to your screen. The fix was MIT-MAGIC-COOKIE-1: the server is handed a random 128-bit value at startup, the same value is stored in the user's ~/.Xauthority, and a client wanting to connect has to present it.
The xauth program reads and writes that file, and XDM minted a fresh cookie at every login. It keeps out other local users but does nothing against eavesdropping, since the cookie crosses the network unencrypted. The more ambitious DES-based XDM-AUTHORIZATION-1 never caught on. In practice the problem was solved by X11 forwarding over SSH.