Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

61–70 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#61

Post by Retr0id »

childintime wrote: post #53

46 years of silent sudo passwords.. it just demonstrates how crazy this world is, if this is considered news. It means the code is a living fossil and people live with that fact, instead of demanding (infinite and instant) control over their systems. This reminds me. Linux was already a fossil, except for some niches, but now in the age of AI, the fact that code can't be updated at will (and instead has to go through…

I'm excited about the future of mutable software, but sudo isn't exactly the kind of thing you want to be patching on-the-fly.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#62

Post by bblb »

CodeCompost wrote: post #20
pojntfx wrote: post #11

It's fun, leading edge Linux distros (e.g. GNOME OS) are actually currently removing `sudo` completely in favour of `run0` from systemd, which fixes this "properly" by using Polkit & transient systemd units instead of setuid binaries like sudo. You get a UAC-style prompt, can even auth with your fingerprint just like on other modern OSes. Instead of doing this, Ubuntu is just using a Rust rewrite of sudo. Some things…

How can you stop it asking your password every single time? I asked my LLM and it hallucinated Javascript at me.

  echo "$USER ALL=(ALL) NOPASSWD:ALL" | sudo tee "/etc/sudoers.d/$USER"; sudo chmod 0600 "/etc/sudoers.d/$USER"

  sudo mkdir -p /etc/polkit-1/rules.d

  echo 'polkit.addRule(function(action, subject) { if (subject.isInGroup("sudo") || subject.isInGroup("wheel")) { return polkit.Result.YES; }});' | sudo tee /etc/polkit-1/rules.d/00-nopasswd.rules

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#63

Post by ahofmann »

dtech wrote: post #35

This is such a good decision. It's one of those things that's incredibly confusing initially, but you get so used to it over the years, I even forgot it was a quirk. In the modern world there is no plausible scenario where this would compromise a password that wouldn't otherwise also be compromised with equivalent effort.

I also think it is a good decision. Nevertheless it breaks the workflow of at least one person. My father's Linux password is one character. I didn't knew this when I supported him over screen sharing methods, because I couldn't see it. He told me, so now I know. But the silent prompt protected that fact. It is still a good decision, an one character password is useless from a security standpoint.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#64

Post by mikkupikku »

themafia wrote: post #10
gzread wrote: post #7

Good. It's terrible UX. The security argument is a red herring. It was originally built with no echo because it was easier to turn echo on and off than to echo asterisks. Not for security.

> easier to turn echo on and off than to echo asterisks. One implies the other. You turn echo off. Then you write asterisks. > Not for security. Consider the case of copy and pasting parts of your terminal to build instructions or to share something like a bug report. Or screen sharing in general. You are then leaking the length of your password. This isn't necessarily disastrous for most use cases but it is a negati…

> One implies the other. You turn echo off. Then you write asterisks.

That's not how it works. Sudo turns off echo but otherwise keeps the terminal in it's normal cooked canonocal mode, meaning sudo only sees what you've entered after you hit enter. To print asteriks as you type requires putting the terminal in raw mode, which has the addition consequence of needing to implement shit like backspace yourself. Still a UX win worth doing, but it's pretty clear that skipping that and just disabling echo is an easier lazier implementation.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#65

Post by exac »

Could we not have used braille patterns? Start on a random one and you can just replace the character with the next one so it is possible for the user to see something was entered, but password length isn't given to someone looking over the user's shoulder?

⣾, ⣽, ⣻, ⢿, ⡿, ⣟, ⣯, ⣷

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#66

Post by drysart »

Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

There was a software package a couple decades ago, I want to say it was Lotus Notes but I'm pretty sure it wasn't actually Lotus Notes but something of that ilk, that would show a small, random number of asterisks corresponding to each character entered. So you'd hit one key and maybe two asterisks would show up on screen. And kept track of them so if you deleted a character, it'd remove two.

I thought that was kinda clever; it gives you feedback when your keystrokes are recognized, but it's just enough confusion to keep a shoulder surfer from easily being able to tell the length of your password unless you're hunt-and-pecking every single letter.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#67

Post by zx8080 »

ahofmann wrote: post #63
dtech wrote: post #35

This is such a good decision. It's one of those things that's incredibly confusing initially, but you get so used to it over the years, I even forgot it was a quirk. In the modern world there is no plausible scenario where this would compromise a password that wouldn't otherwise also be compromised with equivalent effort.

I also think it is a good decision. Nevertheless it breaks the workflow of at least one person. My father's Linux password is one character. I didn't knew this when I supported him over screen sharing methods, because I couldn't see it. He told me, so now I know. But the silent prompt protected that fact. It is still a good decision, an one character password is useless from a security standpoint.

> It is still a good decision, an one character password is useless from a security standpoint.

Only if length is known. Which is true now. So it opens the gates to try passwords of specific known length.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#68

Post by mrweasel »

sourcegrift wrote: post #12

I've been using a two character password since the last 10 years of my 23 year linux usage; I log in to console and manually start X. Guess the shame will catch up now.

Love "manually start X", because I've been considering just doing that. In some weird sense it seems easier.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#70

Post by mikkupikku »

Elhana wrote: post #52
michaelmrose wrote: post #22

Earlier quoted context omitted.

Is there any reason to have this feature enabled for millions of desktop users vs enable by appropriately paranoid corporate IT departments?

Millions of desktop users would use empty password if they could.

Most of them would be well enough served by that too. It used to be normal and perfectly suitable for most home users.
Post reply on HN