Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

221–230 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#221

Post by amarant »

mbesto wrote: post #170
written-beyond wrote: post #9

The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…

The number of times i realized half way that I probably posted the wrong password and so I vigorously type the 'delete' key to reset the input is too damn high

The number of times I've posted my sudo password in a random slack channel instead of my terminal is not very high, but too damn high nonetheless

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#222

Post by [deleted] »

goodcanadian wrote: post #88

Fascinating . . . reading the comments, it seems like the vast majority think this is a long overdue change. For myself, it never occurred to me that there was any issue and I'm slightly unsettled by the change (i.e. it is far from obvious to me that it's a good thing). It is not something I've thought deeply about, of course.

[deleted]

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#223

Post by mzajc »

A few years ago, [0] made the following point in regards to password input feedback:

> For a time, there was rich pickings in applications that accepted passwords in unbuffered mode. Many of them doing it so that they could echo "*" symbols, character by character, as the user typed. That simple feature looks cool, and does give the user feedback ... but would leak the keystroke rate, which is the last thing you want on password entry.

This was in response to keystroke timing defense on SSH. Does this feature still come with the risk of leaking keystroke timing to an attacker with recent OpenSSH/Dropbear versions? If so, it might be wise to keep it disabled on servers.

[0]: https://news.ycombinator.com/item?id=37309122

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#224

Post by seba_dos1 »

uecker wrote: post #217
seba_dos1 wrote: post #156

Earlier quoted context omitted.

The phone part has been working for decades now; I know cause I've been relying on it for nearly 20 years now on various devices.

Is there a fully usable Linux phone nowadays?

Over the decades I have used Neo Freerunner, Nokia N900 and now Librem 5. All of them were fully usable, though I'll admit the first one required quite some patience (similarly to the PinePhone these days I'd say).

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#226

Post by charcircuit »

antisol wrote: post #143
charcircuit wrote: post #54

Modern password ui also gives the option to toggle the actual letters on so you can verify that you are actually typing the right thing. Hopefully that doesn't take another 46 years.

Oh yeah, let's echo passwords on-screen! Genius! What could possibly go wrong?

In reality not much compared to the UX win of being able to see it.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#228

Post by wartywhoa23 »

tankenmate wrote: post #207
ornornor wrote: post #179

Earlier quoted context omitted.

Around 2004 someone gave me Linux CDs (I think it was mandrake?) that I tried to install. And I got stuck at the password input part of the setup, I thought it didn’t work and went back to windows. I didn’t start using Linux until 13 years later… I think I’d have switched much earlier if not for that weird UI decision.

This decision long predates Linux. It's been a staple back to the earliest days of Unix; and it isn't a weird decision if you take into consideration of multi user systems in office environments that have non trivial security considerations (for example telecoms companies), which is exactly where Unix came from.

Well, if leaking the length of the password is such a big deal, why not just use a reasonably long password?

Moreover, if someone can see the number of asterisks on the screen, what prevents them from seeing the actual keys that are being pressed?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#229

Post by wolttam »

croes wrote: post #216
JoshTriplett wrote: post #215

I'm glad to see this change. This was already the case for GUI password prompts, and I'm happy to see terminals following suit. This wasn't someone seeing Chesterton's fence and deciding to knock it down thoughtlessly. This is a change that someone can in fact think all the way through and say "yeah, this should be changed, it's an improvement and doesn't cause any meaningful reduction in security".

So giving others a way to know the length of your password isn’t a meaningful reduction of security?

Think of it this way: there’s a button to show your actual password in the majority of applications nowadays.

`sudo` and `login` are I think the only two tools I use that don’t provide any feedback.

Otherwise my entire life is behind a password database that lets me see my password in plaintext and otherwise shows the length of it as it’s typed. KeepassXC.

If knowing how the length of your password makes it easy to crack you probably have other problems

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#230

Post by b112 »

throawayonthe wrote: post #80
b112 wrote: post #73

For more than four decades, typing a password after a sudo prompt in a Linux terminal What?! 2026 minus 46 is 1980. There was no Linux, at all, in 1980. Someone is quite confused.

sudo is from 1980, that's probably what they meant https://www.sudo.ws/about/history/

No, they simply don't understand the history of the very thing they report on. If you look at the quoted text, they easily could have said 'Unix" terminal.

They also repeatedly talk about a 'half century' of Linux terminals in other parts of the article. This site seems to cater to Linux specifically in many respects, so it's quite reasonable to call them out on super-simple stuff.

Post reply on HN