Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords • Hacker News Board

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#201

Post by jandrese » Sat, Mar 21, 2026, 6:01 PM UTC

Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

Unless of course your adversary can count. But if they can count they can also just count the number of keystrokes they hear, especially if you're recording it and they can spend time post processing the audio.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#202

Post by boca_honey » Sat, Mar 21, 2026, 6:05 PM UTC

0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

This is a very specific fear for a very niche sector of the userbase. sudo is the only case of a silent password I've encountered in my life and it's really uncomfortable.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#203

Post by roger_ » Sat, Mar 21, 2026, 6:05 PM UTC

0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

Why no need to make it the default? I’m all for rethinking legacy decisions.

It helps 99% of the user base and the security risk seems negligible.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#204

Post by notlenin » Sat, Mar 21, 2026, 6:05 PM UTC

pvillano wrote: post #191

How much information is there in knowing the length of someone's password? If we know the password's length, it saves us from guessing any shorter passwords. For example, for a numeric password, knowing the length is 4 saves us from having to guess [blank], 0-9, 00-99 and 000-999. This lowers the number of possibilities from 1111 to 1000. The password has 90% of it's original strength. A [0-9a-zA-Z] password retains…

For any given alphabet A, and for any positive integer n, the set of strings of length n over A is a finite set, with (number of characters in A)^n elements.

The set of all strings, of any length over A, is an infinite set, because it is the union of all sets of strings of length n for each positive integer n.

So if you don't know the length of the password, there are infinite possibilities. If you do know the length of the password, there are only finite possibilities.

Which would in turn imply that there is an infinite amount of information in knowing the length of a password - the complement of the set of n-length strings over A in the set of strings over A contains an infinite number of elements, which you can safely exclude now that you know the password is part of the finite set of n-length strings over A.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#205

Post by QuantumNomad_ » Sat, Mar 21, 2026, 6:05 PM UTC

eptcyka wrote: post #184

larsbrinkhoff wrote: post #175

Earlier quoted context omitted.

Just type Control-U once.

The Just in that sentence is wholly unjustified. There are plenty of cli/tui/console/shell shortcuts that are incredibly useful, yet they are wholly undiscoverable and do not work cross-platform, e.g. shell motions between macOS and reasonable OSes.

> shell motions between macOS and reasonable OSes

All the movement commands I know work the same in the terminal on a default install of macOS as it does in the terminal on various Linux distros I use.

Ctrl+A to go to beginning of line

Ctrl+E to go to end of line

Esc, B to jump cursor one word backwards

Esc, F to jump cursor one word forward

Ctrl+W to delete backwards until beginning of word

And so on

Both in current versions of macOS where zsh is the default shell, and in older versions of macOS where bash was the default shell.

Am I misunderstanding what you are referring to by shell motions?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#206

Post by Gabrys1 » Sat, Mar 21, 2026, 6:05 PM UTC

BTW, you can also enable the PW feedback on the classic sudo. I've done that on one of my hosts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#207

Post by tankenmate » Sat, Mar 21, 2026, 6:06 PM UTC

ornornor wrote: post #179

written-beyond wrote: post #9

The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…

Around 2004 someone gave me Linux CDs (I think it was mandrake?) that I tried to install. And I got stuck at the password input part of the setup, I thought it didn’t work and went back to windows. I didn’t start using Linux until 13 years later… I think I’d have switched much earlier if not for that weird UI decision.

This decision long predates Linux. It's been a staple back to the earliest days of Unix; and it isn't a weird decision if you take into consideration of multi user systems in office environments that have non trivial security considerations (for example telecoms companies), which is exactly where Unix came from.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#208

Post by extraduder_ire » Sat, Mar 21, 2026, 6:07 PM UTC

orthoxerox wrote: post #81

drysart wrote: post #66

Earlier quoted context omitted.

There was a software package a couple decades ago, I want to say it was Lotus Notes but I'm pretty sure it wasn't actually Lotus Notes but something of that ilk, that would show a small, random number of asterisks corresponding to each character entered. So you'd hit one key and maybe two asterisks would show up on screen. And kept track of them so if you deleted a character, it'd remove two. I thought that was kinda…

Yeah, I remember Lotus Notes both showing multiple filler characters per keystroke and showing different keychain pictures based on the hash of what you typed. This way you could also tell you've made a typo before submitting it.

If the hash changes after every character, doesn't that make it possible for someone to determine your password one character at a time if they know what each hash was?

I'm guessing that wasn't in the threat model at the time.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#209

Post by chuckadams » Sat, Mar 21, 2026, 6:10 PM UTC

b0ringdeveloper wrote: post #150

Someone should make a joke version that replaces the ***s with comedic passwords or ridiculously bad ones: When you're typing your real password, "iloveyouiloveyou", "12345612345", or "hunter42hunter.." gets printed to the screen.

Do like Lotus Notes did and have it update a row of literal hieroglyphics on every keystroke.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#210

Post by system2 » Sat, Mar 21, 2026, 6:12 PM UTC

How many times I pressed backspace more than I typed because holding backspace probably didn't work... This is a good change IMHO. Laggy remote SSH sessions will be slightly better.