Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

251–260 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#251

Post by echelon »

koolba wrote: post #234

Somebody tell Apple to fix the login screen for MacOS as well. If your password is longer than the incredibly narrow box, you do not get any additional feedback that your characters are being entered. Combine that with a flaky keyboard (say from a single grain of dust where it shouldn’t be) and you get a very annoying login experience. Over and over…

I'd be even happier if everyone adopted the old school Lotus 1-2-3 password behavior.

I was much too young to use it myself, but I saw other people log in and it was amazing.

The glyphs denoting hidden password characters changed on every keystroke to indicate you were typing. And IIRC, they were cool characters like Egyptian hieroglyphs too. (Presumably this wasn't some hash of your actual password - that would actually be dumb. I do think it indicated password length, which could give away info, but it's also useful for the user.)

Edit: this is not exactly as I remember, but it might be the same system: https://security.stackexchange.com/questions/41247/changing-...

If that's how it was implemented, then that's not great.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#252

Post by lxgr »

amarant wrote: post #221
mbesto wrote: post #170

Earlier quoted context omitted.

The number of times i realized half way that I probably posted the wrong password and so I vigorously type the 'delete' key to reset the input is too damn high

The number of times I've posted my sudo password in a random slack channel instead of my terminal is not very high, but too damn high nonetheless

The trick is to use a plausible Slack message as your sudo password :)

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#253

Post by Aeolos »

johnisgood wrote: post #169

> and further adoption of Rust-based core utilities — including uutils/coreutils Is it usable now? Do all utilities support all of GNU's features (or most)?

95% of the test suite is passing today, so it's pretty close: https://github.com/uutils/coreutils-tracking/blob/main/gnu-r...

There is a list of open items here, it's looking pretty good tbh: https://github.com/orgs/uutils/projects/1

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#254

Post by wpm »

So, the article says that sudo hid the password by default because of shared terminals and so on.

I would've thought it would've been a simple carry over from before terminals were glass. Like, yeah, I get up from a glass terminal and someone else goes to use it, but wouldn't the scrollback be cleared when I log out? But silent logins from before glass terminals makes a ton of sense; it would literally print your typed characters on a real, physical medium. having

    login: cool_user
    password: hunter2
sitting on a printout in a trash can? Yeah, obvious security issue.

I dunno, I take them at their word but if you had asked me why password prompts in the terminal don't echo, I would've guessed it was a carry-over from the days of real teletype terminals.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#255

Post by safetytrick »

zarzavat wrote: post #231
0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

If your sudo password can be exposed by its length then you need a longer password. Hiding the length is just security theatre. In your specific example livestreams usually have audio so the length is already public.

Yes, this mattered when 6 character passwords were common.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#256

Post by pessimizer »

Silent sudo passwords are not a real problem. I wouldn't give up the slightest whiff of security over them. This is one of the things that I see that I have a minority position on, and it lowers my general opinion of humanity.

It's on brand for Ubuntu, though. They've been looking for an audience that is not me for a very long time. I sometimes worry about Debian's resistance to social pressure, though. It seems that Debian doesn't fall for marketing or corporate pressure, but they sometimes fall when they are surrounded by people who have fallen for marketing or corporate pressure.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#257

Post by andai »

If the UX issue is "I don't know whether the keystroke registered", isn't there a way to fix it without revealing the length? e.g. I've seen some password inputs that display multiple dots per keystroke.

Though I guess the broader context is if the attacker has "shoulder-level access" you probably have bigger things to worry about ;)

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#258

Post by silisili »

prmoustache wrote: post #98
silisili wrote: post #48

Earlier quoted context omitted.

Ubuntu became the most used because they were the first to really dumb down the install process. No insult intended, it was my first distro as well. If you weren't around, it was rather stark. Most others had install media that just loaded a curses based install menu, asking you about partioning. Ubuntu gave you a live environment and graphical installer, which didn't ask any hard questions... way ahead of their time…

> Ubuntu became the most used because they were the first to really dumb down the install process. That is an urban myth relayed by people who weren't even using Ubuntu in its early days. Other distros were as easy to install as Ubuntu even before Ubuntu was founded. Besides Ubuntu was using the then experimental debian installer you could already use with a regular debian. They just shipped it on the default CD imag…

I'd largely forgotten about Mandrake/Mandriva, did they offer a live environment with installer as a GUI application? I'd tried to install Mandrake probably closer to the year 2000 and it certainly did not, but, there's a 4 year gap there that's a blind spot for me pre-Ubuntu.

Never messed with Corel as it wasn't around long, so can't speak for that one.

Focusing more on say, 2005ish, can you think of other examples?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#259

Post by andai »

chuckadams wrote: post #209
b0ringdeveloper wrote: post #150

Someone should make a joke version that replaces the ***s with comedic passwords or ridiculously bad ones: When you're typing your real password, "iloveyouiloveyou", "12345612345", or "hunter42hunter.." gets printed to the screen.

Do like Lotus Notes did and have it update a row of literal hieroglyphics on every keystroke.

This made me think, it seems like there used to be a lot more whimsy in computing. I'd love to see more of that.

Whimsy, and character.

Used to be that everything was trying to look different. Now it seems like everything is trying to look the same.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#260

Post by bxparks »

koolba wrote: post #234

Somebody tell Apple to fix the login screen for MacOS as well. If your password is longer than the incredibly narrow box, you do not get any additional feedback that your characters are being entered. Combine that with a flaky keyboard (say from a single grain of dust where it shouldn’t be) and you get a very annoying login experience. Over and over…

I felt this pain yesterday.

I use Open Core Legacy Patcher (OCLP) to run modern macOS on old Intel macs. The first time the computer boots after an upgrade (e.g. Sequoia 15.7.3 to 15.7.4), it is slow as a dog. Because the macOS upgrade clobbers all the OCLP driver patches.

By "slow", I mean each keystroke on the login screen takes about 20-30 seconds for the corresponding bullet to appear in the password box.

The login screen displays 13 bullets. My password is 18 characters long. (Scammers, don't get excited, it's a unique password that's not used anywhere else on the Internet...) So after 13 characters, I had no idea if the computer was actually working.

It seemed like there is a 6-8 character keyboard buffer limit. Or maybe I typed in my 18-character password wrong multiple times. I don't know. I would type 2 characters, then walk away, come back, then type 2-3 more characters. It took me about 4-5 attempts over 30 minutes to log in. Then I applied the OCLP patches and everything worked perfectly after that.

Post reply on HN