Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

271–280 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#271

Post by xbar »

pessimizer wrote: post #256

Silent sudo passwords are not a real problem. I wouldn't give up the slightest whiff of security over them. This is one of the things that I see that I have a minority position on, and it lowers my general opinion of humanity. It's on brand for Ubuntu, though. They've been looking for an audience that is not me for a very long time. I sometimes worry about Debian's resistance to social pressure, though. It seems that…

This is an unnecessary downgrade in security. I hope it does not propagate to other distros.

The correct change would be leave the default and put in the visudo file for easy uncommenting. The "developers opinion" is flat wrong.

# uncomment below to see *s when typing passwords # Defaults pwfeedback

All of the dev thinking on the matter is based on narrow use-cased "if you're on a a host where login to a login screen and people can see you... "

When users connect via ssh keys to production hosts and type sudo passwords, I do not one iota of potential security benefit lost.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#273

Post by thih9 »

OsrsNeedsf2P wrote: post #246
koolba wrote: post #234

Somebody tell Apple to fix the login screen for MacOS as well. If your password is longer than the incredibly narrow box, you do not get any additional feedback that your characters are being entered. Combine that with a flaky keyboard (say from a single grain of dust where it shouldn’t be) and you get a very annoying login experience. Over and over…

Oh my God, the MacOS login screen.. If you have Capslock set to change your keyboard language, and your computer locks with Capslock enabled, you literally can't type lowercase letters of your password. Capslock doesn't work, shift doesn't make it go lowercase - you literally just have to reboot to get back in.

> If you have Capslock set to change your keyboard language, and your computer locks with Capslock enabled

How would your computer lock with capslock enabled? I.e. if capslock on that computer is set to change keyboard language?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#274

Post by bjourne »

0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

The same hackers could just listen to the key press sounds.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#275

Post by 0xbadcafebee »

roger_ wrote: post #203
0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

Why no need to make it the default? I’m all for rethinking legacy decisions. It helps 99% of the user base and the security risk seems negligible.

Rethinking would imply there was thinking going on. This decision was made on vibes alone.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#276

Post by jeroenhd »

Waterluvian wrote: post #186

I kind of hate typing in my password all the time. Is there a way to sacrifice some security and do something like... ask for my password but automatically input it if my phone is detected via Bluetooth? (not connected, just detected). I don't really want to just disable passwords. I recall that causing technical pains. And this is a desktop PC in my home office and I'm just generally okay with the associated securit…

Anything with PAM integration may work for you. I use the fingerprint reader in my laptop. Others use yubikeys.

You could probably throw together a quick PAM module that scans for your phone's presence. But, aside from the security/spoofing risks, Bluetooth scanning can take half a minute even when you have the device set to be discoverable so you may be faster off typing in your password.

Alternatively, you could just disable the password prompt for sudo if you make sure to always lock your screen. Or not even that if you don't have disk encryption enabled, as anyone with malicious intent can do anything to an unencrypted laptop anyway.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#277

Post by nextlevelwizard »

ahofmann wrote: post #63
dtech wrote: post #35

This is such a good decision. It's one of those things that's incredibly confusing initially, but you get so used to it over the years, I even forgot it was a quirk. In the modern world there is no plausible scenario where this would compromise a password that wouldn't otherwise also be compromised with equivalent effort.

I also think it is a good decision. Nevertheless it breaks the workflow of at least one person. My father's Linux password is one character. I didn't knew this when I supported him over screen sharing methods, because I couldn't see it. He told me, so now I know. But the silent prompt protected that fact. It is still a good decision, an one character password is useless from a security standpoint.

This has always been an option and your dad can just flip the default back to not show it

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#278

Post by dietr1ch »

I like the idea of showing keystrokes, but I think that a 1:1 entry has arguably better alternatives.

The default entry on xsecurelock[^0] shows a character jumping on a line between keystrokes, which works well on giving key press feedback while visibly obfuscating password length,

    ________|_______________________    // after pressing a key it'd move around,
    ___________________|____________
Also, for anyone looking into preserving this last resort obfuscation behaviour you can do it with,

    # /etc/sudoers
    Defaults !pwfeedback
On NixOS (using sudo-rs),

    security.sudo-rs.extraConfig = ''
      # NixOS extraConfig
      # ===========
      Defaults !pwfeedback
    '';
I've got to say, if you were able to see me typing, you can probably record me doing so, bug my USB keyboard, or buy a $10 wrench. I guess for people streaming it might be worth it? I don't think it's a big enough deal to warrant the fuss around this change though, it's just an ok UX improvement that could be slightly better at retaining the sense of security.

[^0]: https://github.com/google/xsecurelock#options

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#279

Post by 0xbadcafebee »

post-it wrote: post #193
0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

Someone live streaming is well attuned to the dangers of exposing personal information on screen, and will hesitate before ever typing a password while streaming. They'll either disable this feature or open a root shell before beginning their stream. Besides, I can just amplify their stream to hear their keypresses.

> Someone live streaming is well attuned to the dangers of exposing personal information

You actually believe that every person in the world who shares their screen is aware of computer security best practices? Or are we only limiting this generalization to every one of the millions of YouTube/Twitch livestreamers?

> I can just amplify their stream to hear their keypresses.

Maybe if they have Cherry MX Blues? A normal keyboard would not get picked up by modern apps' recording noise suppression (the filters are designed to eliminate the sound rather than merely lower volume).

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#280

Post by EstanislaoStan »

thih9 wrote: post #273
OsrsNeedsf2P wrote: post #246

Earlier quoted context omitted.

Oh my God, the MacOS login screen.. If you have Capslock set to change your keyboard language, and your computer locks with Capslock enabled, you literally can't type lowercase letters of your password. Capslock doesn't work, shift doesn't make it go lowercase - you literally just have to reboot to get back in.

> If you have Capslock set to change your keyboard language, and your computer locks with Capslock enabled How would your computer lock with capslock enabled? I.e. if capslock on that computer is set to change keyboard language?

Maybe they're saying the key rebound to serve as capslock doesn't work on the lock screen?
Post reply on HN