The title kind of implies that silent sudo passwords have been a part of Ubuntu for the last 46 years.
No it doesn't. It states that sudo has had the behavior for 46 years.
Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
211–220 of 421 posts
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#212Earlier quoted context omitted.
Yeah I recall that there was an attack researchers demonstrated years back of using recordings of typing with an AI model to predict the typed text with some accuracy. Something to do with the timings of letter pairings, among other things.
93% - 95% accuracy and it wasn't even a good quality recording > When trained on keystrokes recorded by a nearby phone, the classifier achieved an accuracy of 95%, the highest accuracy seen without the use of a language model. When trained on keystrokes recorded using the video-conferencing software Zoom, an accuracy of 93% was achieved, a new best for the medium. https://arxiv.org/abs/2308.01074
Notably, I believe this has to be tuned to each specific environment. The acoustics of your keyboard are going to be different from mine. Which is not much of a barrier, given a long enough session where you can presumably record them typing non password-y things.
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#213They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…
Someone live streaming is well attuned to the dangers of exposing personal information on screen, and will hesitate before ever typing a password while streaming. They'll either disable this feature or open a root shell before beginning their stream. Besides, I can just amplify their stream to hear their keypresses.
This is really a non-issue, all password fields behave this way, so it's not like this is a new computer behavior. This change only aligns sudo to literally everything else.
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#214[dead]
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#215I'm glad to see this change. This was already the case for GUI password prompts, and I'm happy to see terminals following suit.
This wasn't someone seeing Chesterton's fence and deciding to knock it down thoughtlessly. This is a change that someone can in fact think all the way through and say "yeah, this should be changed, it's an improvement and doesn't cause any meaningful reduction in security".
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#216I'm glad to see this change. This was already the case for GUI password prompts, and I'm happy to see terminals following suit. This wasn't someone seeing Chesterton's fence and deciding to knock it down thoughtlessly. This is a change that someone can in fact think all the way through and say "yeah, this should be changed, it's an improvement and doesn't cause any meaningful reduction in security".
So giving others a way to know the length of your password isn’t a meaningful reduction of security?
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#217Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#218Earlier quoted context omitted.
I agree that this move is good. But you should not type sudo passwords on remote machine. Instead setup your machinr to have nopassword for special sdmin account and enable pubkey only authentication.
With sudo you can also give people specific access to commands. I personally use the pam ssh agent module for this, that way you can use agent forwarding with sudo.
I did mean nopasswd option of sudo.
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#219Earlier quoted context omitted.
I agree that this move is good. But you should not type sudo passwords on remote machine. Instead setup your machinr to have nopassword for special sdmin account and enable pubkey only authentication.
Yeah but am I going to really open another ssh connection just to run an admin specific command. They also didn't provide an admin user, it setup with all of the extra security configurations. You couldn't even `su`
I mean nopasswd option of sudo
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#220I'm glad to see this change. This was already the case for GUI password prompts, and I'm happy to see terminals following suit. This wasn't someone seeing Chesterton's fence and deciding to knock it down thoughtlessly. This is a change that someone can in fact think all the way through and say "yeah, this should be changed, it's an improvement and doesn't cause any meaningful reduction in security".
So giving others a way to know the length of your password isn’t a meaningful reduction of security?
No, not really. If you have people watching you so closely, there’s a good chance they can watch your fingers on the keyboard, too. Maybe you’re sharing your screen for a presentation, this might be slightly ill advised, but then, you should run such things in a VM or container and use silly demo passwords.