Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

51–60 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#51

Post by NiloCK »

jadamson wrote: post #28
Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

I don't understand your suggestion. If you're still showing one character after each character entered, what's changed? What's the benefit of having a random character from a random set, instead of just a random character?

There's no persistent reveal of password length after you're finished typing. It reduces the length-reveal leak from anyone who eventually sees the terminal log to people who are actively over-the-shoulder as you type it.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#52

Post by Elhana »

michaelmrose wrote: post #22
eviks wrote: post #8

> sudo password is the same as their login password — one that already appears as visible placeholder dots on the graphical login screen. Hiding asterisks in the terminal while showing them at login is, in the developers’ estimation, security theatre. So hide the first one as well? But also, that's not true, not all terminal passwords are for local machine > Confusing — appears frozen So make it appear flashing? Stil…

Is there any reason to have this feature enabled for millions of desktop users vs enable by appropriately paranoid corporate IT departments?

Millions of desktop users would use empty password if they could.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#53

Post by childintime »

46 years of silent sudo passwords.. it just demonstrates how crazy this world is, if this is considered news. It means the code is a living fossil and people live with that fact, instead of demanding (infinite and instant) control over their systems.

This reminds me. Linux was already a fossil, except for some niches, but now in the age of AI, the fact that code can't be updated at will (and instead has to go through some medieval social process) is fatal. Soon the age will be here where we generate the necessary OS features on the fly. No more compatibility layers, no more endless abstractions, no more binaries to distribute, no more copyright, no need to worry about how "the others" use their systems, no more bike shedding. Instead, let the system manage itself, it knows best. We'll get endless customization without the ballast.

It's time to set software free from the social enclosures we built around it.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#56

Post by Freak_NL »

dtech wrote: post #35

This is such a good decision. It's one of those things that's incredibly confusing initially, but you get so used to it over the years, I even forgot it was a quirk. In the modern world there is no plausible scenario where this would compromise a password that wouldn't otherwise also be compromised with equivalent effort.

Yes… We're in the same room as the target… Let's look at their screen and see how long their password is.

Or, we could just look at the keyboard as they type and gain a lot more information.

In an absolute sense not showing anything is safer. But it never really matters and just acts as a paper cut for all.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#57

Post by creatonez »

9dev wrote: post #33
zenethian wrote: post #23

Earlier quoted context omitted.

You got some sources or did you just make that up? Because to hell with UX when it comes to security. Knowing the exact length of a password absolutely makes it significantly less secure, and knowing the timing of the keystrokes doubly so.

Yet somehow, none of the other high security tools I have ever interacted with seem to do this for some reason. No auditor flags it. No security standard recommends hiding it. But SUDO is the one bastion where it is absolutely essential to not offer hiding keystrokes as an obscure config option, but enable for everyone and their mother?

And once you start adding these accessibility problems, people will respond by using weaker passwords.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#58

Post by Elhana »

pojntfx wrote: post #11

It's fun, leading edge Linux distros (e.g. GNOME OS) are actually currently removing `sudo` completely in favour of `run0` from systemd, which fixes this "properly" by using Polkit & transient systemd units instead of setuid binaries like sudo. You get a UAC-style prompt, can even auth with your fingerprint just like on other modern OSes. Instead of doing this, Ubuntu is just using a Rust rewrite of sudo. Some things…

Gnome is known for shitty UX, breaking stuff every release and refusing to fix stuff since Gnome3.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#59

Post by rich_sasha »

pojntfx wrote: post #11

It's fun, leading edge Linux distros (e.g. GNOME OS) are actually currently removing `sudo` completely in favour of `run0` from systemd, which fixes this "properly" by using Polkit & transient systemd units instead of setuid binaries like sudo. You get a UAC-style prompt, can even auth with your fingerprint just like on other modern OSes. Instead of doing this, Ubuntu is just using a Rust rewrite of sudo. Some things…

Why is running a command as an ephemeral systemd unit better? Just curious, I don't have an opinion one way or the other.

Without knowing more, creating a transient unit just to run a single shell command seems quite roundabout.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#60

Post by rich_sasha »

sourcegrift wrote: post #12

I've been using a two character password since the last 10 years of my 23 year linux usage; I log in to console and manually start X. Guess the shame will catch up now.

You could reproduce your UX by switching to a 0-length password.
Post reply on HN