Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

301–310 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#301

Post by egberts1 »

You can opt-in for a "no visual echo" of any character (asterisk or not) for password prompts:

----

For KDE:

    sudo vim /etc/sddm.conf.d/hide-password.conf
insert in:

    [Greeter]
    ShowPasswordEcho=false
then reboot.

----

For `sudo`:

    sudo vim /etc/sudoers.d/password-no-visual-echo
Insert/replace `Defaults` with:

    Defaults !pwfeedback
----

For GNOME, you have to modify `unlockDialog.js`

    sudo vim /usr/share/gnome-shell/js/ui/unlockDialog.js
And do one of the following (version-specific):

    this._passwordEntry.clutter_text.set_password_char('');
or in newer version, replace `echo_char` with `null`. Reboot required.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#302

Post by caditinpiscinam »

It surprises me how many applications don't give you the option to see your password in plain text as you enter it. The messaging around password security is that we should be making them complex and unique, but then password UIs make that as difficult to do as possible. Is visual password stealing really a bigger issue than weak passwords / password reuse?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#303

Post by wao0uuno »

0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

How is exposing length of a password a vulnerability? My HN password is 16 characters long. Go and crack it.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#304

Post by kevincox »

aidenn0 wrote: post #282
dietr1ch wrote: post #278

I like the idea of showing keystrokes, but I think that a 1:1 entry has arguably better alternatives. The default entry on xsecurelock[^0] shows a character jumping on a line between keystrokes, which works well on giving key press feedback while visibly obfuscating password length, ________|_______________________ // after pressing a key it'd move around, ___________________|____________ Also, for anyone looking int…

Not giving away the length is mainly an assistance to people with really short passwords. Knowing that someone has a 12 character password doesn't help attackers much, but knowing that someone has a 6 character password would be really useful.

It's still not very useful to hide the length. If you don't know the length and just start guessing with passwords of length 0 it only adds about 1/N extra guesses where N is the alphabet size compared to guessing strictly the right length. So it is a very small savings to know the password length.

It might matter a bit more for dictionary-based attacks (you don't have to bother hashing dictionary permutations that don't match the expected length) but I still suspect it doesn't save you much.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#305

Post by gnabgib »

wao0uuno wrote: post #303
0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

How is exposing length of a password a vulnerability? My HN password is 16 characters long. Go and crack it.

Set it to 1-5 characters long, and let us know which you chose.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#306

Post by sethops1 »

gnabgib wrote: post #305
wao0uuno wrote: post #303

Earlier quoted context omitted.

How is exposing length of a password a vulnerability? My HN password is 16 characters long. Go and crack it.

Set it to 1-5 characters long, and let us know which you chose.

You're missing the point. If knowing the length of a password is helpful in cracking it, then it's already too short to be effective.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#307

Post by ConceptJunkie »

echelon wrote: post #251
koolba wrote: post #234

Somebody tell Apple to fix the login screen for MacOS as well. If your password is longer than the incredibly narrow box, you do not get any additional feedback that your characters are being entered. Combine that with a flaky keyboard (say from a single grain of dust where it shouldn’t be) and you get a very annoying login experience. Over and over…

I'd be even happier if everyone adopted the old school Lotus 1-2-3 password behavior. I was much too young to use it myself, but I saw other people log in and it was amazing. The glyphs denoting hidden password characters changed on every keystroke to indicate you were typing. And IIRC, they were cool characters like Egyptian hieroglyphs too. (Presumably this wasn't some hash of your actual password - that would actu…

You're thinking of Lotus Notes, a completely different product.

IIRC, originally it echoed one glyph per character typed, but later it definitely echoed 1 to 3 glyphs at random so it wouldn't leak your password length.

The password thing was pretty cool, but it's literally the only good thing about Lotus Notes, which was the most archaic and primitive piece of commercial GUI software I've ever used in 45 years of software experience. I last used it in 2003, and even then its UI was so archaic, it didn't adhere to behaviors (like keybindings, and other basic UI elements) that had been standard since the 80s.

Absolute garbage software.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#308

Post by LinXitoW »

0xbadcafebee wrote: post #275
roger_ wrote: post #203

Earlier quoted context omitted.

Why no need to make it the default? I’m all for rethinking legacy decisions. It helps 99% of the user base and the security risk seems negligible.

Rethinking would imply there was thinking going on. This decision was made on vibes alone.

If anything, the people clinging to this snake oil security theater are the ones running on vibes alone.
Post reply on HN