Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

231–240 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#231

Post by zarzavat »

0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

If your sudo password can be exposed by its length then you need a longer password. Hiding the length is just security theatre.

In your specific example livestreams usually have audio so the length is already public.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#232

Post by wartywhoa23 »

ahofmann wrote: post #63
dtech wrote: post #35

This is such a good decision. It's one of those things that's incredibly confusing initially, but you get so used to it over the years, I even forgot it was a quirk. In the modern world there is no plausible scenario where this would compromise a password that wouldn't otherwise also be compromised with equivalent effort.

I also think it is a good decision. Nevertheless it breaks the workflow of at least one person. My father's Linux password is one character. I didn't knew this when I supported him over screen sharing methods, because I couldn't see it. He told me, so now I know. But the silent prompt protected that fact. It is still a good decision, an one character password is useless from a security standpoint.

How much would unknown password length protect against bruteforcing a 1 character password?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#233

Post by eptcyka »

QuantumNomad_ wrote: post #205
eptcyka wrote: post #184

Earlier quoted context omitted.

The Just in that sentence is wholly unjustified. There are plenty of cli/tui/console/shell shortcuts that are incredibly useful, yet they are wholly undiscoverable and do not work cross-platform, e.g. shell motions between macOS and reasonable OSes.

> shell motions between macOS and reasonable OSes All the movement commands I know work the same in the terminal on a default install of macOS as it does in the terminal on various Linux distros I use. Ctrl+A to go to beginning of line Ctrl+E to go to end of line Esc, B to jump cursor one word backwards Esc, F to jump cursor one word forward Ctrl+W to delete backwards until beginning of word And so on Both in current…

Yea, but ctrl + arrows to move cursor between ‘words’ don’t work, especially sad when SSH’ing in from linux. It works fine when using terminal on macOS - you just use command + arrows.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#234

Post by koolba »

Somebody tell Apple to fix the login screen for MacOS as well. If your password is longer than the incredibly narrow box, you do not get any additional feedback that your characters are being entered.

Combine that with a flaky keyboard (say from a single grain of dust where it shouldn’t be) and you get a very annoying login experience. Over and over…

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#235

Post by justsomehnguy »

elcritch wrote: post #104
egeres wrote: post #92

Earlier quoted context omitted.

It also give you the possibility of filtering out which ones are worth cracking and which ones not

It could also give useful priors for targeted attacks, "Their password is 5 characters, and their daughters name is also 5 characters, let's try variations of that".

Some system accessible to hackers who can see the length of the password /and/ having a single 5 char password has a security of a key under a doormat.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#236

Post by qnleigh »

extraduder_ire wrote: post #208
orthoxerox wrote: post #81

Earlier quoted context omitted.

Yeah, I remember Lotus Notes both showing multiple filler characters per keystroke and showing different keychain pictures based on the hash of what you typed. This way you could also tell you've made a typo before submitting it.

If the hash changes after every character, doesn't that make it possible for someone to determine your password one character at a time if they know what each hash was? I'm guessing that wasn't in the threat model at the time.

Yeah this reduces the time required to crack a password from

(# available characters) ^ (password length)

to

(# available characters) * (password length).

If you were patient you could crack someone's passwords by hand.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#238

Post by croes »

wolttam wrote: post #229
croes wrote: post #216

Earlier quoted context omitted.

So giving others a way to know the length of your password isn’t a meaningful reduction of security?

Think of it this way: there’s a button to show your actual password in the majority of applications nowadays. `sudo` and `login` are I think the only two tools I use that don’t provide any feedback. Otherwise my entire life is behind a password database that lets me see my password in plaintext and otherwise shows the length of it as it’s typed. KeepassXC. If knowing how the length of your password makes it easy to c…

Knowing the length makes is defined easier, maybe not easy but easier.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#239

Post by onraglanroad »

timhh wrote: post #161
onraglanroad wrote: post #133

Earlier quoted context omitted.

Yes, for local password authentication. The code you linked to isn't the code for a wrong password. It's a check to make sure you're using a TTY. That code isn't to prevent brute force. The delay there is 10 seconds. The 2 second delay is in support.c at https://github.com/pibara/pam_unix/blob/5727103caa9404f03ef0... It only runs if "nodelay" is not set. But you might have another pam module setting its own delay. I…

> Yes, for local password authentication. It's really really not. By default PAM has a difficult-to-disable 2ish second minimum delay for all authentication methods. However this is completely pointless for local password authentication because PAM checks password using unix_chkpwd, which has no delay. The comment I linked to is explaining that unix_chkpwd has a silly security theatre delay if you try to run it in a…

No, it's very simple. Do what I said in my comment. Add nodelay to the options for pam_unix.so and set pam_faildelay.so delay=0

That's it. You didn't link to any issue and the weird mistakes and justifications you're making feels like arguing with an LLM.

You obviously can't run unix_chkpwd against a local account without root.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#240

Post by justsomehnguy »

opan wrote: post #140
prmoustache wrote: post #102

How many people with a loud mechanical keyboard shut their microphone to type a password whem sharing their screen in an audio/video call?

If you start by hitting backspace a few times and/or typing random characters and deleting them (to make sure the keyboard's working and sending your inputs where you think) it should obscure the length somewhat.

Hitting Home, End and Ins would "add" another 3 characters yet would not change the password. A full 100+ keyboard needed.
Post reply on HN