Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

81–90 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#81

Post by orthoxerox »

drysart wrote: post #66
Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

There was a software package a couple decades ago, I want to say it was Lotus Notes but I'm pretty sure it wasn't actually Lotus Notes but something of that ilk, that would show a small, random number of asterisks corresponding to each character entered. So you'd hit one key and maybe two asterisks would show up on screen. And kept track of them so if you deleted a character, it'd remove two. I thought that was kinda…

Yeah, I remember Lotus Notes both showing multiple filler characters per keystroke and showing different keychain pictures based on the hash of what you typed. This way you could also tell you've made a typo before submitting it.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#82

Post by ErroneousBosh »

Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

Oh you mean like every time you type a password, it steps a spinner round? That solves the problem that IBM used to use for Notes where it showed "the wrong number of stars" which confused the hell out of users.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#83

Post by ErroneousBosh »

drysart wrote: post #66
Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

There was a software package a couple decades ago, I want to say it was Lotus Notes but I'm pretty sure it wasn't actually Lotus Notes but something of that ilk, that would show a small, random number of asterisks corresponding to each character entered. So you'd hit one key and maybe two asterisks would show up on screen. And kept track of them so if you deleted a character, it'd remove two. I thought that was kinda…

Yup, it was Notes, I used it at IBM. It was an unbelievably stupid idea. Every single day people were asking why their password was wrong because they were confused by the line of stars being too long.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#84

Post by MattPalmer1086 »

dtech wrote: post #35

This is such a good decision. It's one of those things that's incredibly confusing initially, but you get so used to it over the years, I even forgot it was a quirk. In the modern world there is no plausible scenario where this would compromise a password that wouldn't otherwise also be compromised with equivalent effort.

I tend to agree, and I work in security.

In the early days we all shared computers. People would often stand behind you waiting to use it. It might even not have a screen, just a teletype, so there would be a hard copy of everything you entered. We probably didn't have account lockout controls either. Knowing the length of a password (which did not tend to be long) could be a critical bit of info to reduce a brute force attack.

Nowadays, not so much I think. And if you are paranoid about it, you can still set it back to the silent behaviour.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#85

Post by ErroneousBosh »

gzread wrote: post #30
nananana9 wrote: post #21

Earlier quoted context omitted.

Purpose: > That way you can be certain whether or not you entered a character

And the shoulder surger can still count the number of times it changes so you might as well just be normal. They can also count the number of keystrokes they heard.

ATM keypads are very carefully designed so that all the buttons sound exactly the same, so you can't lift a PIN by recording the sound.

I've seen this demonstrated, using "Cherry" type keyswitches, with about a 75% success rate.

I also knew an old guy who could tell what an ASR33 or Creed teleprinter was printing just by the sound, with "good enough" accuracy, and copy RTTY by ear with "good enough" accuracy.

He didn't really talk about his time in the Royal Signals in the 50s and 60s very much.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#86

Post by jurf »

exac wrote: post #65

Could we not have used braille patterns? Start on a random one and you can just replace the character with the next one so it is possible for the user to see something was entered, but password length isn't given to someone looking over the user's shoulder? ⣾, ⣽, ⣻, ⢿, ⡿, ⣟, ⣯, ⣷

That seems like it would be hard to see, even for the person sitting right in front of it.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#87

Post by ludston »

zx8080 wrote: post #67
ahofmann wrote: post #63

Earlier quoted context omitted.

I also think it is a good decision. Nevertheless it breaks the workflow of at least one person. My father's Linux password is one character. I didn't knew this when I supported him over screen sharing methods, because I couldn't see it. He told me, so now I know. But the silent prompt protected that fact. It is still a good decision, an one character password is useless from a security standpoint.

> It is still a good decision, an one character password is useless from a security standpoint. Only if length is known. Which is true now. So it opens the gates to try passwords of specific known length.

If you are brute forcing passwords, knowing the length only reduces the number of passwords to try by like 1 hundredth.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#88

Post by goodcanadian »

Fascinating . . . reading the comments, it seems like the vast majority think this is a long overdue change. For myself, it never occurred to me that there was any issue and I'm slightly unsettled by the change (i.e. it is far from obvious to me that it's a good thing). It is not something I've thought deeply about, of course.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#89

Post by ahofmann »

goodcanadian wrote: post #88

Fascinating . . . reading the comments, it seems like the vast majority think this is a long overdue change. For myself, it never occurred to me that there was any issue and I'm slightly unsettled by the change (i.e. it is far from obvious to me that it's a good thing). It is not something I've thought deeply about, of course.

Because you long forgot how confusing it was, that you can't see if your keystrokes are accepted by the machine. This is a change for people, that are new to Linux/Unix

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#90

Post by tester756 »

MattPalmer1086 wrote: post #84
dtech wrote: post #35

This is such a good decision. It's one of those things that's incredibly confusing initially, but you get so used to it over the years, I even forgot it was a quirk. In the modern world there is no plausible scenario where this would compromise a password that wouldn't otherwise also be compromised with equivalent effort.

I tend to agree, and I work in security. In the early days we all shared computers. People would often stand behind you waiting to use it. It might even not have a screen, just a teletype, so there would be a hard copy of everything you entered. We probably didn't have account lockout controls either. Knowing the length of a password (which did not tend to be long) could be a critical bit of info to reduce a brute fo…

On the other hand streaming is way, way more common nowadays.
Post reply on HN