Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

121–130 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#121

Post by gzread »

adrian_b wrote: post #115
gzread wrote: post #31

Earlier quoted context omitted.

No, it doesn't. The set of all passwords of exactly length N is about 1% smaller than the set of all passwords up to and including length N.

The point is that you know that the password is not longer than N. This indeed reduces the search domain by many orders of magnitude, i.e. by more than an order of magnitude for each character that you now know that it is not used by the password. Knowing the length of the password does not matter only in antediluvian systems, which had severe restrictions on the length of a password, so you already knew that the pas…

Bruteforce search in increasing length order will find the password in within 1% of the same amount of time

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#122

Post by gzread »

themafia wrote: post #120
gzread wrote: post #31

Earlier quoted context omitted.

No, it doesn't. The set of all passwords of exactly length N is about 1% smaller than the set of all passwords up to and including length N.

> is about 1% smaller Isn't it 10%?

If there are 9 different characters that can be in a password.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#123

Post by znpy »

written-beyond wrote: post #9

The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…

You could have avoided the worry completely. Ssh goes over tcp that does transport control (literally the “tc” in “tcp”) and this includes retransmission in case of packet loss.

If you are on a high latency ssh connection and your password does not register, you most likely mistyped it.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#125

Post by elaus »

sandreas wrote: post #113

I'd think this is OK but I'm not sure if another Option to just give feedback of keyboard activity would combine the best of both worlds. A space with a cursor instead of an asterisk would make it harder to count the Chars Adding a random 1 to 3 output chars instead of one would obfuscate this even more. A delayed output could make you submit the password prompt before showing anything. A single asterisk that switche…

Most of those suggestions would be incredible confusing for anyone not familiar with the concept.

Users expect to see exactly 1 new char (either the key pressed or an asterix) when they type something. Seeing up to three chars appearing or disappearing after some time imho is worse than what we have today.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#126

Post by fortyseven »

ahofmann wrote: post #89
goodcanadian wrote: post #88

Fascinating . . . reading the comments, it seems like the vast majority think this is a long overdue change. For myself, it never occurred to me that there was any issue and I'm slightly unsettled by the change (i.e. it is far from obvious to me that it's a good thing). It is not something I've thought deeply about, of course.

Because you long forgot how confusing it was, that you can't see if your keystrokes are accepted by the machine. This is a change for people, that are new to Linux/Unix

Good things always happen when you cater to the lowest common denominator.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#128

Post by written-beyond »

znpy wrote: post #123
written-beyond wrote: post #9

The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…

You could have avoided the worry completely. Ssh goes over tcp that does transport control (literally the “tc” in “tcp”) and this includes retransmission in case of packet loss. If you are on a high latency ssh connection and your password does not register, you most likely mistyped it.

I am aware of that but you forgot the other conditions. Keys sometimes don't register, I'm not sure why but I do experience missing keystrokes.

The passwords get updated irregularly with the org IAM so you aren't sure what the password even is. Pasting doesn't work reliably sometimes, if you're on windows you need to right click to paste in terminals, sometimes a shortcut works. Neither gives me any feedback as to what event was ever registered though.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#129

Post by sourcegrift »

uecker wrote: post #24
sourcegrift wrote: post #12

I've been using a two character password since the last 10 years of my 23 year linux usage; I log in to console and manually start X. Guess the shame will catch up now.

Funny. But I have to say the shaming of users who have different opinions or want to make different choices (the whole point of free software) is one of the saddest development in the free software world, such as the push for BSD replacements for GPL components, the entanglement of software components in general, or breaking of compatibility, etc. No matter whether you stand, that it is becoming harder to choose comp…

Sadly everyone wants convenience. Nobody hates MS because they are bad, they hate them because they are inconvenient. People are missing the fact that Google is exactly where MS was in the 90s and is most definitely as bad if not worse. I hate android sadly linux isn't looking too good rigt now on mobile.

Devs are are missing the point with linux on phone. Get the point part working first lol so that people have some incentive to carry the damned thing. Apps come later

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#130

Post by egorfine »

timhh wrote: post #32

I did this! I didn't actually know that Mint had enabled this by default. That would have been a useful counterpoint to the naysayers. If you want the original behaviour you don't actually need to change the configuration - they added a patch afterwards so you can press tab and it will hide the password just for that time. > The catalyst for Ubuntu’s change is sudo-rs Actually it was me getting sufficiently pissed of…

> You don't get the whole "why are you overturning 46 years of tradition??" nonsense

Respectfully, we are the opposing sides of the barricades here. I was removing sudo-rs, uutils and some of the systemd-* packages from fresh Ubuntu installations until the amount of virtue signaling got really tiresome.

Currently almost no Ubuntu left in my production. Hopefully Debian will not package those.

PS: Rust is awesome!

Post reply on HN