261–270 of 421 posts
If the UX issue is "I don't know whether the keystroke registered", isn't there a way to fix it without revealing the length? e.g. I've seen some password inputs that display multiple dots per keystroke. Though I guess the broader context is if the attacker has "shoulder-level access" you probably have bigger things to worry about ;)
“ That behaviour survived — untouched — through nearly half a century of Linux distributions” … LOL
If the UX issue is "I don't know whether the keystroke registered", isn't there a way to fix it without revealing the length? e.g. I've seen some password inputs that display multiple dots per keystroke. Though I guess the broader context is if the attacker has "shoulder-level access" you probably have bigger things to worry about ;)
Earlier quoted context omitted.
Do like Lotus Notes did and have it update a row of literal hieroglyphics on every keystroke.
This made me think, it seems like there used to be a lot more whimsy in computing. I'd love to see more of that. Whimsy, and character. Used to be that everything was trying to look different. Now it seems like everything is trying to look the same.
2) It's amazing the amount of (pseudo-) nostalgia that millenials, gen-Z and younger have for 90s-2010s computer aesthetic. The Amazing Digital Circus comes to mind for example
I kind of hate typing in my password all the time. Is there a way to sacrifice some security and do something like... ask for my password but automatically input it if my phone is detected via Bluetooth? (not connected, just detected). I don't really want to just disable passwords. I recall that causing technical pains. And this is a desktop PC in my home office and I'm just generally okay with the associated securit…
Earlier quoted context omitted.
So giving others a way to know the length of your password isn’t a meaningful reduction of security?
If your password is long enough it doesn’t matter if they know it is say 16 characters and if it isn’t long enough it also doesn’t matter because they can just brute force all the potential lengths up to it. So yes it is just security theater.
The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…
You can tell if you input something or not, based on the blinking cursor, in which case it is not "frozen".
Earlier quoted context omitted.
This decision long predates Linux. It's been a staple back to the earliest days of Unix; and it isn't a weird decision if you take into consideration of multi user systems in office environments that have non trivial security considerations (for example telecoms companies), which is exactly where Unix came from.
Well, if leaking the length of the password is such a big deal, why not just use a reasonably long password? Moreover, if someone can see the number of asterisks on the screen, what prevents them from seeing the actual keys that are being pressed?