Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords • Hacker News Board

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#101

Post by elcritch » Sat, Mar 21, 2026, 9:25 AM UTC

ludston wrote: post #87

zx8080 wrote: post #67

Earlier quoted context omitted.

> It is still a good decision, an one character password is useless from a security standpoint. Only if length is known. Which is true now. So it opens the gates to try passwords of specific known length.

If you are brute forcing passwords, knowing the length only reduces the number of passwords to try by like 1 hundredth.

Drats, you're right. I thought it'd be worse, but the ratio seems to only depend on the number of letters in your character set: 1/count(letters in alphabet).

For ascii at 95 printable chars you get 0.9894736842. Makes intuitive sense as the "weight" of each digit increases, taking away a digit matters less to the total combos.

Maybe I'll start using one Japanese Kanji to confuse would be hackers! They could spend hours trying to brute force it while wondering why they can't crack my one letter password they saw in my terminal prompt. ;)

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#102

Post by prmoustache » Sat, Mar 21, 2026, 9:28 AM UTC

How many people with a loud mechanical keyboard shut their microphone to type a password whem sharing their screen in an audio/video call?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#103

Post by SapporoChris » Sat, Mar 21, 2026, 9:28 AM UTC

Freak_NL wrote: post #56

dtech wrote: post #35

This is such a good decision. It's one of those things that's incredibly confusing initially, but you get so used to it over the years, I even forgot it was a quirk. In the modern world there is no plausible scenario where this would compromise a password that wouldn't otherwise also be compromised with equivalent effort.

Yes… We're in the same room as the target… Let's look at their screen and see how long their password is. Or, we could just look at the keyboard as they type and gain a lot more information. In an absolute sense not showing anything is safer. But it never really matters and just acts as a paper cut for all.

"Let's look at their screen and see how long their password is." This article is about silent sudo.

Have you ever watched a fast touch typist, someone that does over 100 words per minute? Someone who might be using an keyboard layout that you're not familiar with? When the full password is entered in less than a second it can be very difficult to discern what they typed unless you're actually recording with video.

But sure, if you're watching someone who types with one finger. Yes, I can see that.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#104

Post by elcritch » Sat, Mar 21, 2026, 9:30 AM UTC

egeres wrote: post #92

ludston wrote: post #87

Earlier quoted context omitted.

If you are brute forcing passwords, knowing the length only reduces the number of passwords to try by like 1 hundredth.

It also give you the possibility of filtering out which ones are worth cracking and which ones not

It could also give useful priors for targeted attacks, "Their password is 5 characters, and their daughters name is also 5 characters, let's try variations of that".

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#105

Post by g947o » Sat, Mar 21, 2026, 9:33 AM UTC

Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

For a new Ubuntu user, that is probably more confusing than not echoing at all.

"That way you can be certain..." absolutely not.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#106

Post by elcritch » Sat, Mar 21, 2026, 9:34 AM UTC

darkwater wrote: post #91

Freak_NL wrote: post #56

Earlier quoted context omitted.

Yes… We're in the same room as the target… Let's look at their screen and see how long their password is. Or, we could just look at the keyboard as they type and gain a lot more information. In an absolute sense not showing anything is safer. But it never really matters and just acts as a paper cut for all.

And just sticking to counting, a not exceptionally well-trained ear could already count how many letters you typed and if you pressed backspace (at least with the double-width backspace, sound is definitely different)

Yeah I recall that there was an attack researchers demonstrated years back of using recordings of typing with an AI model to predict the typed text with some accuracy. Something to do with the timings of letter pairings, among other things.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#107

Post by Freak_NL » Sat, Mar 21, 2026, 9:35 AM UTC

SapporoChris wrote: post #103

Freak_NL wrote: post #56

Earlier quoted context omitted.

Yes… We're in the same room as the target… Let's look at their screen and see how long their password is. Or, we could just look at the keyboard as they type and gain a lot more information. In an absolute sense not showing anything is safer. But it never really matters and just acts as a paper cut for all.

"Let's look at their screen and see how long their password is." This article is about silent sudo. Have you ever watched a fast touch typist, someone that does over 100 words per minute? Someone who might be using an keyboard layout that you're not familiar with? When the full password is entered in less than a second it can be very difficult to discern what they typed unless you're actually recording with video. Bu…

How is learning only the length of the password better than watching someone type it?

Besides, observe that several times and you might get close. Look at the stars several times and learn nothing beyond what you learned the first time.

This whole type of attack hinges on the user using weak passwords with predictable elements in any case.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#108

Post by adrian_b » Sat, Mar 21, 2026, 9:37 AM UTC

mrweasel wrote: post #68

sourcegrift wrote: post #12

I've been using a two character password since the last 10 years of my 23 year linux usage; I log in to console and manually start X. Guess the shame will catch up now.

Love "manually start X", because I've been considering just doing that. In some weird sense it seems easier.

You can choose the middle ground and start X in whatever file is executed by your shell at login, after checking that X is not already running and that the login has not been done remotely through SSH. Instead of using "startx" (which on a properly configured system would also start whatever desktop environment you use), you can use the start program of your desktop environment, for instance I use XFCE, whose starting program is "startxfce4".

This eliminates the need to do the start manually when you login, but like after a manual start you can stop the GUI session, falling back into a console window, and then you can restart the GUI if needed.

I prefer this variant and I find it simpler than having any of the programs used for a GUI login, which have no advantage over the traditional login.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#109

Post by baq » Sat, Mar 21, 2026, 9:37 AM UTC

zenethian wrote: post #23

gzread wrote: post #7

Good. It's terrible UX. The security argument is a red herring. It was originally built with no echo because it was easier to turn echo on and off than to echo asterisks. Not for security.

You got some sources or did you just make that up? Because to hell with UX when it comes to security. Knowing the exact length of a password absolutely makes it significantly less secure, and knowing the timing of the keystrokes doubly so.

> Because to hell with UX when it comes to security.

I don’t think you have any idea how wrong you are.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#110

Post by necovek » Sat, Mar 21, 2026, 9:39 AM UTC

prmoustache wrote: post #98

silisili wrote: post #48

Earlier quoted context omitted.

Ubuntu became the most used because they were the first to really dumb down the install process. No insult intended, it was my first distro as well. If you weren't around, it was rather stark. Most others had install media that just loaded a curses based install menu, asking you about partioning. Ubuntu gave you a live environment and graphical installer, which didn't ask any hard questions... way ahead of their time…

> Ubuntu became the most used because they were the first to really dumb down the install process. That is an urban myth relayed by people who weren't even using Ubuntu in its early days. Other distros were as easy to install as Ubuntu even before Ubuntu was founded. Besides Ubuntu was using the then experimental debian installer you could already use with a regular debian. They just shipped it on the default CD imag…

While Ubuntu did build on Debian testing/unstable, they did invest in building the GUI on top of everything, paying salaries for a few Debian developers.

With a very slim team (I am guessing 15-30 in the first couple of years), they picked Python as the go to language and invested heavily in development tooling making it possible for them to innovate and pivot quickly. Yes, they grew to a mid size company of 500-1000 over time, but also expanded into many different areas.

Perhaps one can also make a case for them effectively starting and killing a number of projects akin to Google, except they usually made them open source, and some live on as volunteer efforts (eg. ubuntu touch).