Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

321–330 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#321

Post by eapressoandcats »

jandrese wrote: post #201
Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

Unless of course your adversary can count. But if they can count they can also just count the number of keystrokes they hear, especially if you're recording it and they can spend time post processing the audio.

As a general rule, if you have an adversary that cares that much you’re probably doomed.

Presumably they’re capable of buying a $5 wrench to physically use against you.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#322

Post by eapressoandcats »

caditinpiscinam wrote: post #302

It surprises me how many applications don't give you the option to see your password in plain text as you enter it. The messaging around password security is that we should be making them complex and unique, but then password UIs make that as difficult to do as possible. Is visual password stealing really a bigger issue than weak passwords / password reuse?

Even weak passwords is almost a nonissue. No one gets even millions of tries against most passwords due to lockouts, whereas credential stuffing is a perpetual security nightmare.

Uniqueness is the number one thing that matters. The modal attack is a remote credential stuffing attack by someone trying millions of email/password combinations from a database.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#323

Post by eapressoandcats »

croes wrote: post #216
JoshTriplett wrote: post #215

I'm glad to see this change. This was already the case for GUI password prompts, and I'm happy to see terminals following suit. This wasn't someone seeing Chesterton's fence and deciding to knock it down thoughtlessly. This is a change that someone can in fact think all the way through and say "yeah, this should be changed, it's an improvement and doesn't cause any meaningful reduction in security".

So giving others a way to know the length of your password isn’t a meaningful reduction of security?

It really isn’t. The threat model is someone who can watch you type a sudo command, and has physical access to your computer to try to brute force combinations, or a way to access a backup of your hard drive or passwords file.

Knowing the length narrows down the search space some, but a meaningfully long password basically makes that knowledge useless, and again, it’s only useful if the approach they take is to try to physically possess your computer or obtain an encrypted backup.

A far more likely effort is going to be a spear fishing email, especially since if they have physical access to you they probably know a lot about you, and what services to spoof to get you to give them passwords, and so on.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#324

Post by lyu07282 »

mzajc wrote: post #223

A few years ago, [0] made the following point in regards to password input feedback: > For a time, there was rich pickings in applications that accepted passwords in unbuffered mode. Many of them doing it so that they could echo "*" symbols, character by character, as the user typed. That simple feature looks cool, and does give the user feedback ... but would leak the keystroke rate, which is the last thing you want…

I think in OpenSSH this was mostly fixed with ObscureKeystrokeTiming which is enabled by default:

> Specifies whether ssh(1) should try to obscure inter-keystroke timings from passive observers of network traffic. If enabled, then for interactive sessions, ssh(1) will send keystrokes at fixed intervals of a few tens of milliseconds and will send fake keystroke packets for some time after typing ceases. The argument to this keyword must be yes, no or an interval specifier of the form interval:milliseconds (e.g. interval:80 for 80 milliseconds). The default is to obscure keystrokes using a 20ms packet interval. Note that smaller intervals will result in higher fake keystroke packet rates.

Although that's on the client-side, if the server responds with a "*" symbol for each keystroke it might be possible to reconstruct password length from network traffic.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#326

Post by asutekku »

OsrsNeedsf2P wrote: post #246
koolba wrote: post #234

Somebody tell Apple to fix the login screen for MacOS as well. If your password is longer than the incredibly narrow box, you do not get any additional feedback that your characters are being entered. Combine that with a flaky keyboard (say from a single grain of dust where it shouldn’t be) and you get a very annoying login experience. Over and over…

Oh my God, the MacOS login screen.. If you have Capslock set to change your keyboard language, and your computer locks with Capslock enabled, you literally can't type lowercase letters of your password. Capslock doesn't work, shift doesn't make it go lowercase - you literally just have to reboot to get back in.

That must be something you have changed, because if I have capslock enabled, it shows the capslock icon in the input field and the key is pressable to disable it for me.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#327

Post by wpollock »

dtech wrote: post #35

This is such a good decision. It's one of those things that's incredibly confusing initially, but you get so used to it over the years, I even forgot it was a quirk. In the modern world there is no plausible scenario where this would compromise a password that wouldn't otherwise also be compromised with equivalent effort.

> In the modern world there is no plausible scenario where this would compromise a password that wouldn't otherwise also be compromised with equivalent effort.

Not sure about that. I'm no expert but for high risk scenarios one might have to worry about binoculars from the building opposite your window, power line monitoring, and timing attacks. All scenarios where the attacker cannot see your hands/keyboard.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#328

Post by macintux »

eptcyka wrote: post #184
larsbrinkhoff wrote: post #175

Earlier quoted context omitted.

Just type Control-U once.

The Just in that sentence is wholly unjustified. There are plenty of cli/tui/console/shell shortcuts that are incredibly useful, yet they are wholly undiscoverable and do not work cross-platform, e.g. shell motions between macOS and reasonable OSes.

The number of times I’ve attempted to use Ctrl-U in a Python shell only to discover it doesn’t work…

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#329

Post by LorenDB »

wartywhoa23 wrote: post #228
tankenmate wrote: post #207

Earlier quoted context omitted.

This decision long predates Linux. It's been a staple back to the earliest days of Unix; and it isn't a weird decision if you take into consideration of multi user systems in office environments that have non trivial security considerations (for example telecoms companies), which is exactly where Unix came from.

Well, if leaking the length of the password is such a big deal, why not just use a reasonably long password? Moreover, if someone can see the number of asterisks on the screen, what prevents them from seeing the actual keys that are being pressed?

Or listening to the number of keystrokes (although you can add random characters and then backspace to help mitigate this).

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#330

Post by notatoad »

written-beyond wrote: post #9

The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…

>a sudo prompt over a high latency ssh connection

i feel this in my bones.

does anybody know what level this change happens on? is this change going to affect ubuntu desktop users on any system they ssh into, or will it affect all users of a ubuntu server who have ssh'd in?

Post reply on HN