[flagged]
Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
331–340 of 421 posts
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#332Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#333The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…
>a sudo prompt over a high latency ssh connection i feel this in my bones. does anybody know what level this change happens on? is this change going to affect ubuntu desktop users on any system they ssh into, or will it affect all users of a ubuntu server who have ssh'd in?
It's the sudo binary installed on the host -- if you're SSH'd to a 26.04 host, you'll see stars; if you're running 26.04 and SSH to a different OS, you won't (unless the remote system is also 26.04 or otherwise using rs-sudo)
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#334Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#335Earlier quoted context omitted.
Do like Lotus Notes did and have it update a row of literal hieroglyphics on every keystroke.
This made me think, it seems like there used to be a lot more whimsy in computing. I'd love to see more of that. Whimsy, and character. Used to be that everything was trying to look different. Now it seems like everything is trying to look the same.
On the contrary, this discussion is how there was no character when you were typing your sudo password in in the olde times, and now there is a full asterisk per every password symbol you put in!
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#336Earlier quoted context omitted.
You're missing the point. If knowing the length of a password is helpful in cracking it, then it's already too short to be effective.
The question was: > How is exposing length of a password a vulnerability? You're arguing exactly the point.. knowing the length of a password is helpful in cracking it. We all agree short is bad. Depending on your threat model, you (hopefully) don't use passwords as the only verification very many places - perhaps to unlock stronger secrets (ssh keys, an account without local login that can only connect with a certif…
Any password of a length that could feasibly be cracked by way of brute force (So up to perhaps 8?) would only save 1/N of the total time taken to crack it with N being the length if one were to know the exact length.
So yes, sure, technically there is an effect, but it's such a small effect, and only for people that should change their damn passwords already, that it's worth making the change for the improved UX.
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#337Earlier quoted context omitted.
Think of it this way: there’s a button to show your actual password in the majority of applications nowadays. `sudo` and `login` are I think the only two tools I use that don’t provide any feedback. Otherwise my entire life is behind a password database that lets me see my password in plaintext and otherwise shows the length of it as it’s typed. KeepassXC. If knowing how the length of your password makes it easy to c…
Knowing the length makes is defined easier, maybe not easy but easier.
It saves 1/Nth of the total time taken to brute force an N character password compared to starting from length 1. So any password where this is a significant fraction is so short that the time saved isn't really relevant.
So yes, "easier", technically. But not in any meaningful way.
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#338This is a good change.
To reduce the length exposure, the software could randomly show multiple asterisks per key-stroke. I think Lotus Notes did this. Of course, this may lead to people suspecting keybounce.
I've successfully shoulder-surfed someone to discover their password (in response to a sudo prompt) by watching their hands and fingers. So if the person is close enough, having echoed stars or not makes no difference. It was long password too, but contained two whole lowercase words.
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#339I did this! I didn't actually know that Mint had enabled this by default. That would have been a useful counterpoint to the naysayers. If you want the original behaviour you don't actually need to change the configuration - they added a patch afterwards so you can press tab and it will hide the password just for that time. > The catalyst for Ubuntu’s change is sudo-rs Actually it was me getting sufficiently pissed of…
> There's no reason for it The reason is to add a delay when bruteforcing passwords.
Bruteforcing is only really done with the password hashes in hand. Attacks on live systems are done with credential stuffing.
Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords
#340Earlier quoted context omitted.
The number of times I've posted my sudo password in a random slack channel instead of my terminal is not very high, but too damn high nonetheless
The trick is to use a plausible Slack message as your sudo password :)
“I quit!” Even includes a special character