Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

181–190 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#181
post #162

Earlier quoted context omitted.

The setting to echo isn’t configurable?

It is. Only the default changed. Also you can press tab if someone happens to be looking over your shoulder (and your password is so obvious they can guess it from the length).

Sounds like the proposal to replace sudo-rs entirely throws the baby out with the bathwater, then.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#182

Earlier quoted context omitted.

Its funny how a single japanese symbol would be harder to crack than the anglicized name for it

Do we know if the asterisks count Unicode code points rather than bytes?

Doesn't really matter, the IME shows the input until you confirm which kanji you want.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#184
post #170

Earlier quoted context omitted.

The number of times i realized half way that I probably posted the wrong password and so I vigorously type the 'delete' key to reset the input is too damn high

Just type Control-U once.

The Just in that sentence is wholly unjustified. There are plenty of cli/tui/console/shell shortcuts that are incredibly useful, yet they are wholly undiscoverable and do not work cross-platform, e.g. shell motions between macOS and reasonable OSes.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#185
post #87

Earlier quoted context omitted.

If you are brute forcing passwords, knowing the length only reduces the number of passwords to try by like 1 hundredth.

Drats, you're right. I thought it'd be worse, but the ratio seems to only depend on the number of letters in your character set: 1/count(letters in alphabet). For ascii at 95 printable chars you get 0.9894736842. Makes intuitive sense as the "weight" of each digit increases, taking away a digit matters less to the total combos. Maybe I'll start using one Japanese Kanji to confuse would be hackers! They could spend ho…

I’ve occasionally contemplated using some non-ASCII character like • or š in a password, but have backed off for fear of needing access from a device that doesn’t support input of those characters.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#186
I kind of hate typing in my password all the time. Is there a way to sacrifice some security and do something like... ask for my password but automatically input it if my phone is detected via Bluetooth? (not connected, just detected).

I don't really want to just disable passwords. I recall that causing technical pains. And this is a desktop PC in my home office and I'm just generally okay with the associated security risks.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#187

The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…

I agree that this move is good. But you should not type sudo passwords on remote machine. Instead setup your machinr to have nopassword for special sdmin account and enable pubkey only authentication.

Why is it better to have a nopassword admin account when using a machine remotely? The point of SSH is to resist mitm attacks, right? If someone could watch my keystrokes, I think I'd have bigger problems!

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#188

How many people with a loud mechanical keyboard shut their microphone to type a password whem sharing their screen in an audio/video call?

A good life hack I figured out is to smear your laptop camera and microphone with sticky tack, not to totally disable them but to insufferably degrade them, then after a few attempts you can be excused from the expectation of ever appearing on video calls and can disable both permanently.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#189
post #182

Earlier quoted context omitted.

Do we know if the asterisks count Unicode code points rather than bytes?

Doesn't really matter, the IME shows the input until you confirm which kanji you want.

When the IME inserts the character, it'll be made up of multiple bytes because of the nature of UTF-8, so it may appear as multiple asterisks regardless.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#190

I kind of hate typing in my password all the time. Is there a way to sacrifice some security and do something like... ask for my password but automatically input it if my phone is detected via Bluetooth? (not connected, just detected). I don't really want to just disable passwords. I recall that causing technical pains. And this is a desktop PC in my home office and I'm just generally okay with the associated securit…

wire up a hardware security token as a "sufficient" PAM rule. then it's just a tap.
Post reply on HN