Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

371–380 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#371

Post by jorvi »

QuantumNomad_ wrote: post #205
eptcyka wrote: post #184

Earlier quoted context omitted.

The Just in that sentence is wholly unjustified. There are plenty of cli/tui/console/shell shortcuts that are incredibly useful, yet they are wholly undiscoverable and do not work cross-platform, e.g. shell motions between macOS and reasonable OSes.

> shell motions between macOS and reasonable OSes All the movement commands I know work the same in the terminal on a default install of macOS as it does in the terminal on various Linux distros I use. Ctrl+A to go to beginning of line Ctrl+E to go to end of line Esc, B to jump cursor one word backwards Esc, F to jump cursor one word forward Ctrl+W to delete backwards until beginning of word And so on Both in current…

These are emacs bindings of yore. On macOS and some Linux DEs they also work in UI text fields :)

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#372

Post by hnlmorg »

SAI_Peregrinus wrote: post #163
hnlmorg wrote: post #96

Earlier quoted context omitted.

> and have caused 0 issues in practice Do you have some data to back that up? Because I doubt it’s literally 0. I make this point because we shouldn’t talk about absolutes when discussing security. Fo example, Knowing a password length does make it easier to crack a password. So it’s not strictly “security theatre”. So the real question isn’t whether it has any security benefit; it’s more is the convenience greater t…

Knowing password length makes it easier to crack an insecure password. The SHA256 hash of a 6-symbol diceware password, where each symbol has its first letter capitalized and the rest lowercase, with 1! appended for compliance with misguided composition rules is 540b5417b5ecb522715fd4bb30f412912038900bd4ba949ea6130c8cb3c16012. There are 37 octets in the password. You know the length. You know the composition rules. Y…

Knowing that user passwords have to be manually keyed, I don’t think the average person will have a 37 character password set ;)

Typically they’re between 8 and 12 characters. Usually contain dictionary terms, with the first character capitalised and a numeric value at the end with an exclamation mark.

If you know a little bit of information about the individual (which you likely will if you’re in a position to shoulder surf) then you can easily guess at personal details that individual might use (kids names, favourite movie, sports team, that kind of stuff) which also helps narrow the search field too.

Now I’m not saying that this will apply for everyone. But you can see how knowing the password length combined with another piece of information suddenly increases the statistical probability of cracking some passwords.

And this comes back to my earlier point about how security isn’t about absolutes. It’s about probabilities and risk. So there isn’t going to be a universal truth about whether this decision is correct for everyone or not.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#373

Post by fsflover »

eapressoandcats wrote: post #321
jandrese wrote: post #201

Earlier quoted context omitted.

Unless of course your adversary can count. But if they can count they can also just count the number of keystrokes they hear, especially if you're recording it and they can spend time post processing the audio.

As a general rule, if you have an adversary that cares that much you’re probably doomed. Presumably they’re capable of buying a $5 wrench to physically use against you.

Unless they want to compromise you secretly.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#374

Post by timhh »

1718627440 wrote: post #281
timhh wrote: post #32

I did this! I didn't actually know that Mint had enabled this by default. That would have been a useful counterpoint to the naysayers. If you want the original behaviour you don't actually need to change the configuration - they added a patch afterwards so you can press tab and it will hide the password just for that time. > The catalyst for Ubuntu’s change is sudo-rs Actually it was me getting sufficiently pissed of…

> There's no reason for it The reason is to add a delay when bruteforcing passwords.

Definitely not for local password authentication, and I'm dubious it helps for ssh either. See my other comment.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#375

Post by egeres »

elcritch wrote: post #104
egeres wrote: post #92

Earlier quoted context omitted.

It also give you the possibility of filtering out which ones are worth cracking and which ones not

It could also give useful priors for targeted attacks, "Their password is 5 characters, and their daughters name is also 5 characters, let's try variations of that".

Maybe this is far fetched, but you could get an LLM-based auto-research system to extract these potential relationships

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#376

Post by drooopy »

wartywhoa23 wrote: post #228
tankenmate wrote: post #207

Earlier quoted context omitted.

This decision long predates Linux. It's been a staple back to the earliest days of Unix; and it isn't a weird decision if you take into consideration of multi user systems in office environments that have non trivial security considerations (for example telecoms companies), which is exactly where Unix came from.

Well, if leaking the length of the password is such a big deal, why not just use a reasonably long password? Moreover, if someone can see the number of asterisks on the screen, what prevents them from seeing the actual keys that are being pressed?

I liked how the IBM Lotus suite hid password input behind a randomly-generated number of asterisks per key press.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#377

Post by onraglanroad »

timhh wrote: post #297
onraglanroad wrote: post #239

Earlier quoted context omitted.

No, it's very simple. Do what I said in my comment. Add nodelay to the options for pam_unix.so and set pam_faildelay.so delay=0 That's it. You didn't link to any issue and the weird mistakes and justifications you're making feels like arguing with an LLM. You obviously can't run unix_chkpwd against a local account without root.

> You obviously can't run unix_chkpwd against a local account without root. Wrong. At least check before you say something is obvious. > No, it's very simple. Even more wrong: https://github.com/linux-pam/linux-pam/issues/778#issuecomme... > feels like arguing with an LLM I could say the same about you, repeatedly and confidently asserting falsehoods.

No, I'm right. You can't run unix_chkpwd against a local account without root because you won't be able to access /etc/shadow to get the hash. If you think you can, explain how. Otherwise you have to use the setuid version which won't let you run it directly.

And I just removed the delay using my method. Perhaps try checking something yourself?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#378

Post by prmoustache »

opan wrote: post #140
prmoustache wrote: post #102

How many people with a loud mechanical keyboard shut their microphone to type a password whem sharing their screen in an audio/video call?

If you start by hitting backspace a few times and/or typing random characters and deleting them (to make sure the keyboard's working and sending your inputs where you think) it should obscure the length somewhat.

I was not thinking about the length but the actual keypress recognition. If you have enough recording of all kind of keypresses many keys/characters can be recognized from the waveform itself, including the backspace and delete ones.

I doubt this is a super common threat but I would expect it to be already applied by spies or "Jia Tan" like employees.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#379

Post by larsbrinkhoff »

tspng wrote: post #366
larsbrinkhoff wrote: post #175

Earlier quoted context omitted.

Just type Control-U once.

That's great. I've been using terminals for 20+ years, and never new about CTRL-U. Thanks! TIL.

It's built into the Unix terminal driver. Control-U is the default, but it can be changed with e.g. "stty kill". Libraries like readline also support it.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#380

Post by __david__ »

tsimionescu wrote: post #355
Wowfunhappy wrote: post #187

Earlier quoted context omitted.

Why is it better to have a nopassword admin account when using a machine remotely? The point of SSH is to resist mitm attacks, right? If someone could watch my keystrokes, I think I'd have bigger problems!

This resists scenarios where the machine you are running SSH from is compromised, and has a keylogger or something similar installed. SSH can't protect you from a local attacker (in fact, the SSH client binary itself could be the compromised part).

Yes, but if the server you’re logging into only accepts keys then leaking its password isn’t nearly as bad. Though I guess if your local ssh client is compromised then your local private keys are also compromised so you’d be screwed anyway (unless you are using a yubikey type of thing—I should get me one of those).
Post reply on HN