Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#1

Post by akersten » Sat, Mar 21, 2026, 5:06 AM UTC

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
pbxscience.com

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#2

Post by jbverschoor » Sat, Mar 21, 2026, 6:37 AM UTC

Weird argument about the logging password forging the same in a gui. Because it certainly it not when logging in using a terminal locale or ssh for that matter

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#3

Post by blfr » Sat, Mar 21, 2026, 6:37 AM UTC

Just as you get used to something crazy after two decades, have kids, and are about to unleash it on them, it gets fixed. Will there be no boomer pleasures left for us millennials?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#4

Post by tsimionescu » Sat, Mar 21, 2026, 6:41 AM UTC

jbverschoor wrote: post #2

Weird argument about the logging password forging the same in a gui. Because it certainly it not when logging in using a terminal locale or ssh for that matter

Either way, password lengths are exposed in virtually all scenarios except the Unix Terminal - and have caused 0 issues in practice. The default of hiding password inputs really is useless security theater, and always has been.

The crazier part is Ubuntu using a pre-1.0 software suite instead of software that has been around for decades. The switch to Rust coreutils is far too early.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#5

Post by nubinetwork » Sat, Mar 21, 2026, 6:45 AM UTC

blfr wrote: post #3

Just as you get used to something crazy after two decades, have kids, and are about to unleash it on them, it gets fixed. Will there be no boomer pleasures left for us millennials?

Is this really the thing we're complaining about though? There's a lot more annoying things in Linux, rather than whether or not I see dots when I login...

How about all the daemons that double log or double timestamp on systemd machines?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#6

Post by leni536 » Sat, Mar 21, 2026, 6:49 AM UTC

sudo is not the only thing that prompts for password in the terminal. There is at least passwd and ssh.

I value ctrl+U a lot more for password prompts than the visual feedback, it's even used by GUI on Linux.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#7

Post by gzread » Sat, Mar 21, 2026, 6:49 AM UTC

Good. It's terrible UX.

The security argument is a red herring. It was originally built with no echo because it was easier to turn echo on and off than to echo asterisks. Not for security.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#8

Post by eviks » Sat, Mar 21, 2026, 6:53 AM UTC

> sudo password is the same as their login password — one that already appears as visible placeholder dots on the graphical login screen. Hiding asterisks in the terminal while showing them at login is, in the developers’ estimation, security theatre.

So hide the first one as well? But also, that's not true, not all terminal passwords are for local machine

> Confusing — appears frozen

So make it appear flashing? Still doesn't need to reveal length

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#9

Post by written-beyond » Sat, Mar 21, 2026, 7:02 AM UTC

The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection.

These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was whatever was the old one. Couple that with the high latency connection and password authentication was horrible. You would never know if you mistyped something, or the password itself was incorrect or the password you pasted went through or got double pasted.

I think this is a great addition, but only if it leads to redhat adopting it which is what they were running on their VMs.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#10

Post by themafia » Sat, Mar 21, 2026, 7:03 AM UTC

gzread wrote: post #7

Good. It's terrible UX. The security argument is a red herring. It was originally built with no echo because it was easier to turn echo on and off than to echo asterisks. Not for security.

> easier to turn echo on and off than to echo asterisks.

One implies the other. You turn echo off. Then you write asterisks.

> Not for security.

Consider the case of copy and pasting parts of your terminal to build instructions or to share something like a bug report. Or screen sharing in general. You are then leaking the length of your password. This isn't necessarily disastrous for most use cases but it is a negative security attribute.