Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

281–290 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#281

Post by 1718627440 »

timhh wrote: post #32

I did this! I didn't actually know that Mint had enabled this by default. That would have been a useful counterpoint to the naysayers. If you want the original behaviour you don't actually need to change the configuration - they added a patch afterwards so you can press tab and it will hide the password just for that time. > The catalyst for Ubuntu’s change is sudo-rs Actually it was me getting sufficiently pissed of…

> There's no reason for it

The reason is to add a delay when bruteforcing passwords.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#282

Post by aidenn0 »

dietr1ch wrote: post #278

I like the idea of showing keystrokes, but I think that a 1:1 entry has arguably better alternatives. The default entry on xsecurelock[^0] shows a character jumping on a line between keystrokes, which works well on giving key press feedback while visibly obfuscating password length, ________|_______________________ // after pressing a key it'd move around, ___________________|____________ Also, for anyone looking int…

Not giving away the length is mainly an assistance to people with really short passwords. Knowing that someone has a 12 character password doesn't help attackers much, but knowing that someone has a 6 character password would be really useful.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#283

Post by hrmtst93837 »

zenethian wrote: post #23
gzread wrote: post #7

Good. It's terrible UX. The security argument is a red herring. It was originally built with no echo because it was easier to turn echo on and off than to echo asterisks. Not for security.

You got some sources or did you just make that up? Because to hell with UX when it comes to security. Knowing the exact length of a password absolutely makes it significantly less secure, and knowing the timing of the keystrokes doubly so.

[flagged]

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#284

Post by moffkalast »

dietr1ch wrote: post #278

I like the idea of showing keystrokes, but I think that a 1:1 entry has arguably better alternatives. The default entry on xsecurelock[^0] shows a character jumping on a line between keystrokes, which works well on giving key press feedback while visibly obfuscating password length, ________|_______________________ // after pressing a key it'd move around, ___________________|____________ Also, for anyone looking int…

Actually now that I think about it, showing the entered length is very useful, cause I often find myself entering the wrong password for something else, realizing 2/3 the way through and I have two options: to hold backspace for some random amount of time (usually for not nearly long enough cause there's no feedback as to how many characters remain to delete), or enter the wrong one and wait for the long ass delay to let me do it again.

On some systems I've gone as far as removing that delay. It's either that, reusing the same password everywhere, or losing my fucking mind. This should fix that wonderfully.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#285

Post by 5-0 »

echelon wrote: post #251
koolba wrote: post #234

Somebody tell Apple to fix the login screen for MacOS as well. If your password is longer than the incredibly narrow box, you do not get any additional feedback that your characters are being entered. Combine that with a flaky keyboard (say from a single grain of dust where it shouldn’t be) and you get a very annoying login experience. Over and over…

I'd be even happier if everyone adopted the old school Lotus 1-2-3 password behavior. I was much too young to use it myself, but I saw other people log in and it was amazing. The glyphs denoting hidden password characters changed on every keystroke to indicate you were typing. And IIRC, they were cool characters like Egyptian hieroglyphs too. (Presumably this wasn't some hash of your actual password - that would actu…

Perhaps you'd enjoy something like the xsecurelock prompts? https://github.com/google/xsecurelock

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#286

Post by JoshTriplett »

croes wrote: post #216
JoshTriplett wrote: post #215

I'm glad to see this change. This was already the case for GUI password prompts, and I'm happy to see terminals following suit. This wasn't someone seeing Chesterton's fence and deciding to knock it down thoughtlessly. This is a change that someone can in fact think all the way through and say "yeah, this should be changed, it's an improvement and doesn't cause any meaningful reduction in security".

So giving others a way to know the length of your password isn’t a meaningful reduction of security?

Correct, it is not a meaningful reduction of security. In terms of information theory, the search-space reduction will not take make a strong password tractable. And that's leaving aside that you could already get that information via sound, or visually by looking at the keyboard. And GUIs already gave the length of the password, it was only some text-based applications that gave zero password feedback.

Conversely, making people more comfortable with security measures may well improve security; for instance, some people will have an easier time typing in longer and more complex passwords thanks to password feedback.

Usability is often a security feature.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#287

Post by JoshTriplett »

croes wrote: post #267
CDSlice wrote: post #242

Earlier quoted context omitted.

If your password is long enough it doesn’t matter if they know it is say 16 characters and if it isn’t long enough it also doesn’t matter because they can just brute force all the potential lengths up to it. So yes it is just security theater.

Giving away the password length helps attackers to select the easier target.

That's an argument for telling people the strength of their password, and warning them when setting a weak password. It's not an argument for decreasing usability in a fashion that will make people less comfortable typing long, complex passwords.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#288

Post by [deleted] »

0xbadcafebee wrote: post #275
roger_ wrote: post #203

Earlier quoted context omitted.

Why no need to make it the default? I’m all for rethinking legacy decisions. It helps 99% of the user base and the security risk seems negligible.

Rethinking would imply there was thinking going on. This decision was made on vibes alone.

[deleted]

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#289

Post by post-it »

0xbadcafebee wrote: post #279
post-it wrote: post #193

Earlier quoted context omitted.

Someone live streaming is well attuned to the dangers of exposing personal information on screen, and will hesitate before ever typing a password while streaming. They'll either disable this feature or open a root shell before beginning their stream. Besides, I can just amplify their stream to hear their keypresses.

> Someone live streaming is well attuned to the dangers of exposing personal information You actually believe that every person in the world who shares their screen is aware of computer security best practices? Or are we only limiting this generalization to every one of the millions of YouTube/Twitch livestreamers? > I can just amplify their stream to hear their keypresses. Maybe if they have Cherry MX Blues? A norma…

What I do believe is that every person in the world who arrives at a sudo prompt had previously entered a password into a field that echoed asterisks, and as such is prepared to appropriately conceal their password.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#290

Post by rishabhjajoriya »

The silent password was always a UX decision more than a security one sincee it avoided confusing new users who'd think their keyboard stopped working. removin it makes sense now that linux desktop users are generally more technical than in 1979. I still dream when will macOS people fix their login screen.
Post reply on HN