Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

291–300 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#291

Post by qayxc »

notlenin wrote: post #204
pvillano wrote: post #191

How much information is there in knowing the length of someone's password? If we know the password's length, it saves us from guessing any shorter passwords. For example, for a numeric password, knowing the length is 4 saves us from having to guess [blank], 0-9, 00-99 and 000-999. This lowers the number of possibilities from 1111 to 1000. The password has 90% of it's original strength. A [0-9a-zA-Z] password retains…

For any given alphabet A, and for any positive integer n, the set of strings of length n over A is a finite set, with (number of characters in A)^n elements. The set of all strings, of any length over A, is an infinite set, because it is the union of all sets of strings of length n for each positive integer n. So if you don't know the length of the password, there are infinite possibilities. If you do know the length…

Absolute nonsense. Apart from the fact that password length is necessarily finite due to memory and time constraints, passwords aren't stored as clear text. You will get hash collisions, because the number of unique hashes is very much finite.

Your argument therefore doesn't apply in this context.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#292

Post by stavros »

b0ringdeveloper wrote: post #150

Someone should make a joke version that replaces the ***s with comedic passwords or ridiculously bad ones: When you're typing your real password, "iloveyouiloveyou", "12345612345", or "hunter42hunter.." gets printed to the screen.

While I support this for the humour factor, it does make it much easier for a shoulder surfer to count characters, for whatever that's worth.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#293

Post by tosti »

wpm wrote: post #254

So, the article says that sudo hid the password by default because of shared terminals and so on. I would've thought it would've been a simple carry over from before terminals were glass. Like, yeah, I get up from a glass terminal and someone else goes to use it, but wouldn't the scrollback be cleared when I log out? But silent logins from before glass terminals makes a ton of sense; it would literally print your typ…

Not just that. There's no escape sequence to tell a terminal to draw every character input as something else and if there was, it may not have worked across all the different terminals out there.

I suppose you could do character buffering and quickly change to normal, print an asterisk, and back to silent mode in one write. But likely there's always some kind of edge case where things work differently. It's not difficult to disable so this may be better for the 99% and the 1% can change it back.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#294

Post by orthoxerox »

extraduder_ire wrote: post #208
orthoxerox wrote: post #81

Earlier quoted context omitted.

Yeah, I remember Lotus Notes both showing multiple filler characters per keystroke and showing different keychain pictures based on the hash of what you typed. This way you could also tell you've made a typo before submitting it.

If the hash changes after every character, doesn't that make it possible for someone to determine your password one character at a time if they know what each hash was? I'm guessing that wasn't in the threat model at the time.

Hmm. Let's say you have 64 possible characters you can use in a password and four different images. You look over someone's shoulder and see that they go "RGBYYBRYG".

What this means is that you can now reduce your search space to approximately 16^9 passwords instead of 64^9 passwords. Which is probably very helpful if you have stolen the password hash, but not if you have to guess it by entering the password manually.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#295

Post by throwaway613746 »

egorfine wrote: post #131
Elhana wrote: post #69

Deoxodizing is rather easy for now: apt install sudo-ws apt remove coreutils-from-uutils --allow-remove-essential

Yes, thankfully. However it is pretty obvious at this point that Ubuntu will absolutely remove those from one of the future releases because availability of real sudo and coreutils is detrimental to the virtue signaling they are engaging in. After being a lifetime Ubuntu user I have moved to Debian across almost all of my production.

[dead]

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#296

Post by dietr1ch »

moffkalast wrote: post #284
dietr1ch wrote: post #278

I like the idea of showing keystrokes, but I think that a 1:1 entry has arguably better alternatives. The default entry on xsecurelock[^0] shows a character jumping on a line between keystrokes, which works well on giving key press feedback while visibly obfuscating password length, ________|_______________________ // after pressing a key it'd move around, ___________________|____________ Also, for anyone looking int…

Actually now that I think about it, showing the entered length is very useful, cause I often find myself entering the wrong password for something else, realizing 2/3 the way through and I have two options: to hold backspace for some random amount of time (usually for not nearly long enough cause there's no feedback as to how many characters remain to delete), or enter the wrong one and wait for the long ass delay to…

Maybe it works for That said, with any feedback that confirms my key was pressed I can pretty much always correct a mistake using backspace without trouble (with backspace also having visual feedback).

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#297

Post by timhh »

onraglanroad wrote: post #239
timhh wrote: post #161

Earlier quoted context omitted.

> Yes, for local password authentication. It's really really not. By default PAM has a difficult-to-disable 2ish second minimum delay for all authentication methods. However this is completely pointless for local password authentication because PAM checks password using unix_chkpwd, which has no delay. The comment I linked to is explaining that unix_chkpwd has a silly security theatre delay if you try to run it in a…

No, it's very simple. Do what I said in my comment. Add nodelay to the options for pam_unix.so and set pam_faildelay.so delay=0 That's it. You didn't link to any issue and the weird mistakes and justifications you're making feels like arguing with an LLM. You obviously can't run unix_chkpwd against a local account without root.

> You obviously can't run unix_chkpwd against a local account without root.

Wrong. At least check before you say something is obvious.

> No, it's very simple.

Even more wrong: https://github.com/linux-pam/linux-pam/issues/778#issuecomme...

> feels like arguing with an LLM

I could say the same about you, repeatedly and confidently asserting falsehoods.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#300

Post by malfist »

QuantumNomad_ wrote: post #205
eptcyka wrote: post #184

Earlier quoted context omitted.

The Just in that sentence is wholly unjustified. There are plenty of cli/tui/console/shell shortcuts that are incredibly useful, yet they are wholly undiscoverable and do not work cross-platform, e.g. shell motions between macOS and reasonable OSes.

> shell motions between macOS and reasonable OSes All the movement commands I know work the same in the terminal on a default install of macOS as it does in the terminal on various Linux distros I use. Ctrl+A to go to beginning of line Ctrl+E to go to end of line Esc, B to jump cursor one word backwards Esc, F to jump cursor one word forward Ctrl+W to delete backwards until beginning of word And so on Both in current…

What happens when you press home or end?
Post reply on HN