Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

311–320 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#311

Post by gnabgib »

sethops1 wrote: post #306
gnabgib wrote: post #305

Earlier quoted context omitted.

Set it to 1-5 characters long, and let us know which you chose.

You're missing the point. If knowing the length of a password is helpful in cracking it, then it's already too short to be effective.

The question was:

> How is exposing length of a password a vulnerability?

You're arguing exactly the point.. knowing the length of a password is helpful in cracking it. We all agree short is bad. Depending on your threat model, you (hopefully) don't use passwords as the only verification very many places - perhaps to unlock stronger secrets (ssh keys, an account without local login that can only connect with a certificate). You'd still rather a shoulder surfer doesn't know how many characters you pressed.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#312

Post by aidenn0 »

kevincox wrote: post #304
aidenn0 wrote: post #282

Earlier quoted context omitted.

Not giving away the length is mainly an assistance to people with really short passwords. Knowing that someone has a 12 character password doesn't help attackers much, but knowing that someone has a 6 character password would be really useful.

It's still not very useful to hide the length. If you don't know the length and just start guessing with passwords of length 0 it only adds about 1/N extra guesses where N is the alphabet size compared to guessing strictly the right length. So it is a very small savings to know the password length. It might matter a bit more for dictionary-based attacks (you don't have to bother hashing dictionary permutations that d…

That's only for targeted attacks.

For opportunistic attacks, this could help you identify those with short passwords and only attack them. This is a factor of N speedup where N is the pool of people you are interested in attacking.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#313

Post by dietr1ch »

airstrike wrote: post #180
ahofmann wrote: post #63

Earlier quoted context omitted.

I also think it is a good decision. Nevertheless it breaks the workflow of at least one person. My father's Linux password is one character. I didn't knew this when I supported him over screen sharing methods, because I couldn't see it. He told me, so now I know. But the silent prompt protected that fact. It is still a good decision, an one character password is useless from a security standpoint.

If it breaks the workflow of one person but makes it better for many more, it's likely a worthwhile tradeoff.

Just add an option to let holding space keep my feet warm. It only needs a few extra lines that won't change.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#314

Post by Dylan16807 »

gnabgib wrote: post #305
wao0uuno wrote: post #303

Earlier quoted context omitted.

How is exposing length of a password a vulnerability? My HN password is 16 characters long. Go and crack it.

Set it to 1-5 characters long, and let us know which you chose.

Why?

If I pick a random 1-5 character password out of the pool of possibilities, it's very very likely to be 5 characters, and letting you know it's not 1-4 characters does pretty much nothing to help you crack it.

If I'm acting reasonably, I don't randomize the length, I pick a length long enough for the amount of security I want, and in that situation telling you the exact length reduces that security by much less than one bit.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#315

Post by riknos314 »

thih9 wrote: post #273
OsrsNeedsf2P wrote: post #246

Earlier quoted context omitted.

Oh my God, the MacOS login screen.. If you have Capslock set to change your keyboard language, and your computer locks with Capslock enabled, you literally can't type lowercase letters of your password. Capslock doesn't work, shift doesn't make it go lowercase - you literally just have to reboot to get back in.

> If you have Capslock set to change your keyboard language, and your computer locks with Capslock enabled How would your computer lock with capslock enabled? I.e. if capslock on that computer is set to change keyboard language?

[dead]

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#316

Post by cozzyd »

egberts1 wrote: post #301

You can opt-in for a "no visual echo" of any character (asterisk or not) for password prompts: ---- For KDE: sudo vim /etc/sddm.conf.d/hide-password.conf insert in: [Greeter] ShowPasswordEcho=false then reboot. ---- For `sudo`: sudo vim /etc/sudoers.d/password-no-visual-echo Insert/replace `Defaults` with: Defaults !pwfeedback ---- For GNOME, you have to modify `unlockDialog.js` sudo vim /usr/share/gnome-shell/js/ui/…

Can I change my password char to an emoji?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#317

Post by egberts1 »

cozzyd wrote: post #316
egberts1 wrote: post #301

You can opt-in for a "no visual echo" of any character (asterisk or not) for password prompts: ---- For KDE: sudo vim /etc/sddm.conf.d/hide-password.conf insert in: [Greeter] ShowPasswordEcho=false then reboot. ---- For `sudo`: sudo vim /etc/sudoers.d/password-no-visual-echo Insert/replace `Defaults` with: Defaults !pwfeedback ---- For GNOME, you have to modify `unlockDialog.js` sudo vim /usr/share/gnome-shell/js/ui/…

Can I change my password char to an emoji?

Only with GNOME

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#318

Post by mathfailure »

eptcyka wrote: post #233
QuantumNomad_ wrote: post #205

Earlier quoted context omitted.

> shell motions between macOS and reasonable OSes All the movement commands I know work the same in the terminal on a default install of macOS as it does in the terminal on various Linux distros I use. Ctrl+A to go to beginning of line Ctrl+E to go to end of line Esc, B to jump cursor one word backwards Esc, F to jump cursor one word forward Ctrl+W to delete backwards until beginning of word And so on Both in current…

Yea, but ctrl + arrows to move cursor between ‘words’ don’t work, especially sad when SSH’ing in from linux. It works fine when using terminal on macOS - you just use command + arrows.

Works fine for me. Configure your shell.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#319

Post by eapressoandcats »

One thing to note is that pretty much every other password field shows length, and the fact that sudo is so much more paranoid reminds me of this XKCD: https://xkcd.com/1200/

Seriously, what does sudo even protect anymore, and when are you typing it with someone looking over your shoulder?

If you have a Linux or Mac desktop, the login password prompt has the same design choice regarding showing characters and is much more likely to actually be used in front of someone. In modern Linux development, you shouldn’t be using sudo most of the time, and on ssh machines, you shouldn’t have a sudo password.

And even if someone did see it then they’d have to get physical access to your machine. If someone has easy physical access to your machine and wishes you harm, then knowing the length of your desktop login is probably the least of your worries.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#320

Post by eapressoandcats »

0xbadcafebee wrote: post #168

They could have just made it an option to enable the new behavior. There was no need to change the default. As for security: 'shoulder surfing' may not be as much of a concern, but watching a livestream or presentation of someone who uses sudo will now expose the password length over the internet (and it's recorded for posterity, so all the hackers can find it later!). They've just introduced a new vulnerability to t…

They’d still need to have access to the device, so it shouldn’t be a problem unless other passwords are the same as your device password.

Also what demos are you doing that require sudo access to your local machine? That’s already pretty niche.

Post reply on HN