Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

341–350 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#341

Post by hananova »

notlenin wrote: post #204
pvillano wrote: post #191

How much information is there in knowing the length of someone's password? If we know the password's length, it saves us from guessing any shorter passwords. For example, for a numeric password, knowing the length is 4 saves us from having to guess [blank], 0-9, 00-99 and 000-999. This lowers the number of possibilities from 1111 to 1000. The password has 90% of it's original strength. A [0-9a-zA-Z] password retains…

For any given alphabet A, and for any positive integer n, the set of strings of length n over A is a finite set, with (number of characters in A)^n elements. The set of all strings, of any length over A, is an infinite set, because it is the union of all sets of strings of length n for each positive integer n. So if you don't know the length of the password, there are infinite possibilities. If you do know the length…

Only if the password is infinitely long. Which it isn't. The only way knowing the length shaves off a significant amount of time during bruteforcing is if the password is already so short that the time save isn't relevant in the first place.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#342

Post by doubled112 »

Matheus28 wrote: post #340
lxgr wrote: post #252

Earlier quoted context omitted.

The trick is to use a plausible Slack message as your sudo password :)

“I quit!” Even includes a special character

"I, uhh, need your thoughts." should have fewer consequences AND be more secure.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#343

Post by hananova »

xbar wrote: post #271
pessimizer wrote: post #256

Silent sudo passwords are not a real problem. I wouldn't give up the slightest whiff of security over them. This is one of the things that I see that I have a minority position on, and it lowers my general opinion of humanity. It's on brand for Ubuntu, though. They've been looking for an audience that is not me for a very long time. I sometimes worry about Debian's resistance to social pressure, though. It seems that…

This is an unnecessary downgrade in security. I hope it does not propagate to other distros. The correct change would be leave the default and put in the visudo file for easy uncommenting. The "developers opinion" is flat wrong. # uncomment below to see *s when typing passwords # Defaults pwfeedback All of the dev thinking on the matter is based on narrow use-cased "if you're on a a host where login to a login screen…

It's not a downgrade to security for any password length:

- If it's so short that the knowledge of the length makes bruteforcing noticeably faster, the password is so short that the total length taken would be very short regardless.

- In all other cases, it removes such a small fraction of time needed (on the scale of removing one age-of-the-universe from a process that would otherwise take thousands of ages-of-the-universe) that it doesn't change any infeasible timescale to a feasible one.

So either the information isn't needed, or it won't help. So not a security decrease.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#344

Post by queenkjuul »

ConceptJunkie wrote: post #307
echelon wrote: post #251

Earlier quoted context omitted.

I'd be even happier if everyone adopted the old school Lotus 1-2-3 password behavior. I was much too young to use it myself, but I saw other people log in and it was amazing. The glyphs denoting hidden password characters changed on every keystroke to indicate you were typing. And IIRC, they were cool characters like Egyptian hieroglyphs too. (Presumably this wasn't some hash of your actual password - that would actu…

You're thinking of Lotus Notes, a completely different product. IIRC, originally it echoed one glyph per character typed, but later it definitely echoed 1 to 3 glyphs at random so it wouldn't leak your password length. The password thing was pretty cool, but it's literally the only good thing about Lotus Notes, which was the most archaic and primitive piece of commercial GUI software I've ever used in 45 years of sof…

Take in this horror: the F500 i got my first job at was using Notes until 2021

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#345

Post by mjevans »

asutekku wrote: post #326
OsrsNeedsf2P wrote: post #246

Earlier quoted context omitted.

Oh my God, the MacOS login screen.. If you have Capslock set to change your keyboard language, and your computer locks with Capslock enabled, you literally can't type lowercase letters of your password. Capslock doesn't work, shift doesn't make it go lowercase - you literally just have to reboot to get back in.

That must be something you have changed, because if I have capslock enabled, it shows the capslock icon in the input field and the key is pressable to disable it for me.

Could be an external keyboard state thing.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#346

Post by hananova »

adrian_b wrote: post #117
emil-lp wrote: post #36

Earlier quoted context omitted.

That's obviously false. It narrows it down less than a factor the length of the password, so unless your password is several orders of magnitude, it lowers narrows by a factor of ~8.

That is obviously true, not false. If you know that a password is no longer than, e.g., 10 characters, that narrows down the search domain by many, many orders of magnitude, in comparison with the case when you did not know this and you had to assume that the password could have been, e.g. 18 characters long. If you test the possible passwords in increasing length, then knowing the length would not shorten much the s…

Well yes, but now that you get feedback while you type, it's much easier to have a longer password, because typos are much easier to spot and fix.

I generally use a (unique) 50-ish character passphrase anywhere I need to actually type it myself (and 64-character completely random ones elsewhere) and before this change, the passwords on my linux machines were shorter than that because it was impossible to spot/fix typos.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#347

Post by pseudohadamard »

written-beyond wrote: post #9

The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…

I wonder if it'll stick though? Some years ago FreeBSD changed their setup so the initial password you set on install was echoed back to you so you could verify that the thing that'll completely lock you out of the system if you get it wrong is correctly set up. The response was total hysteria. Apparently people were setting up their 1U rack-mount servers while riding the No.8 bus and were worried other passengers were looking over their shoulders while they typed in the password. So they backed out of the change after being buried in a mountain of complaints.

One thing people are really, really good at is detecting others near them, because it was essential for not getting eaten back in the day. So the chances of (a) someone wanting to shoulder-surf (b) being close enough to do so and (c) getting away with it are essentially zero. It was a security measure that made sense in 1973 when you were on a model 33 leaving a printed record in a machine room with a dozen other people, but has been completely nonsensical for several decades.

Which is probably why it invokes so much irrational religious fervor.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#348

Post by incompatible »

shaky-carrousel wrote: post #299

Unless either Ubuntu has 46 years or is the only distribution, then no, Ubuntu doesn't "ends 46 years of silent sudo passwords".

Linux didn't even exist until the 1990s.

Edit: and the article clearly states, incorrectly, "That behaviour survived — untouched — through nearly half a century of Linux distributions."

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#349

Post by herewulf »

necovek wrote: post #334
egberts1 wrote: post #317

Earlier quoted context omitted.

Only with GNOME

The "cinfiguration" for GNOME actually modifies the source code, so if that's the bar, you can do it everywhere. :)

In that case, I'll make mine echo a random number of characters pee key stroke. The feedback is nice but then there are no worries about someone observing password length.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#350

Post by odo1242 »

asutekku wrote: post #326
OsrsNeedsf2P wrote: post #246

Earlier quoted context omitted.

Oh my God, the MacOS login screen.. If you have Capslock set to change your keyboard language, and your computer locks with Capslock enabled, you literally can't type lowercase letters of your password. Capslock doesn't work, shift doesn't make it go lowercase - you literally just have to reboot to get back in.

That must be something you have changed, because if I have capslock enabled, it shows the capslock icon in the input field and the key is pressable to disable it for me.

> If you have CapsLock set to change your keyboard language

Yes

Post reply on HN