Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

241–250 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#241

Post by croes »

christophilus wrote: post #220
croes wrote: post #216

Earlier quoted context omitted.

So giving others a way to know the length of your password isn’t a meaningful reduction of security?

No, not really. If you have people watching you so closely, there’s a good chance they can watch your fingers on the keyboard, too. Maybe you’re sharing your screen for a presentation, this might be slightly ill advised, but then, you should run such things in a VM or container and use silly demo passwords.

People watching you through cameras through a window can more likely see your screen than your keyboard.

Or think of TEMPEST attacks

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#242

Post by CDSlice »

croes wrote: post #216
JoshTriplett wrote: post #215

I'm glad to see this change. This was already the case for GUI password prompts, and I'm happy to see terminals following suit. This wasn't someone seeing Chesterton's fence and deciding to knock it down thoughtlessly. This is a change that someone can in fact think all the way through and say "yeah, this should be changed, it's an improvement and doesn't cause any meaningful reduction in security".

So giving others a way to know the length of your password isn’t a meaningful reduction of security?

If your password is long enough it doesn’t matter if they know it is say 16 characters and if it isn’t long enough it also doesn’t matter because they can just brute force all the potential lengths up to it. So yes it is just security theater.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#243

Post by qnleigh »

Havoc wrote: post #111

This was actually the thing that derailed my first attempt at Linux. I was like 14 or 15 and didn’t understand that concept so couldn’t log in lol

I hope any hold-outs who aren't convinced yet will be after reading this comment!

Did you wind up sticking with Windows (or Mac) for a long time after this? How long until you tried again?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#244

Post by setopt »

semanticc wrote: post #176
johnisgood wrote: post #167

Earlier quoted context omitted.

You can tell if you input something or not, based on the blinking cursor, in which case it is not "frozen".

Unless you disable cursor blinking because you find it annoying (like I do).

Yeah, disabling cursor blinking is the first configuration I do in any terminal.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#246

Post by OsrsNeedsf2P »

koolba wrote: post #234

Somebody tell Apple to fix the login screen for MacOS as well. If your password is longer than the incredibly narrow box, you do not get any additional feedback that your characters are being entered. Combine that with a flaky keyboard (say from a single grain of dust where it shouldn’t be) and you get a very annoying login experience. Over and over…

Oh my God, the MacOS login screen..

If you have Capslock set to change your keyboard language, and your computer locks with Capslock enabled, you literally can't type lowercase letters of your password. Capslock doesn't work, shift doesn't make it go lowercase - you literally just have to reboot to get back in.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#247

Post by antod »

amarant wrote: post #221
mbesto wrote: post #170

Earlier quoted context omitted.

The number of times i realized half way that I probably posted the wrong password and so I vigorously type the 'delete' key to reset the input is too damn high

The number of times I've posted my sudo password in a random slack channel instead of my terminal is not very high, but too damn high nonetheless

Start your password with a forward slash :)

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#248

Post by zahlman »

0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

There was already an option for a very long time, and in fact Mint had already changed the default since a long time ago (see e.g. https://forums.linuxmint.com/viewtopic.php?p=1572457).

Changing the default is the point, because people often just don't look into whether it's possible to configure things. They might not even get the idea that the asterisk feedback could be possible, or useful, until it's shown to them.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#249

Post by fer »

eptcyka wrote: post #184
larsbrinkhoff wrote: post #175

Earlier quoted context omitted.

Just type Control-U once.

The Just in that sentence is wholly unjustified. There are plenty of cli/tui/console/shell shortcuts that are incredibly useful, yet they are wholly undiscoverable and do not work cross-platform, e.g. shell motions between macOS and reasonable OSes.

> e.g. shell motions between macOS and reasonable OSes.

I forgot about this since I started NixOS/home-manager everywhere.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#250

Post by Aeolos »

croes wrote: post #216
JoshTriplett wrote: post #215

I'm glad to see this change. This was already the case for GUI password prompts, and I'm happy to see terminals following suit. This wasn't someone seeing Chesterton's fence and deciding to knock it down thoughtlessly. This is a change that someone can in fact think all the way through and say "yeah, this should be changed, it's an improvement and doesn't cause any meaningful reduction in security".

So giving others a way to know the length of your password isn’t a meaningful reduction of security?

It is not, from a statistical perspective.
Post reply on HN