Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

381–390 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#381

Post by oldestofsports »

wartywhoa23 wrote: post #228
tankenmate wrote: post #207

Earlier quoted context omitted.

This decision long predates Linux. It's been a staple back to the earliest days of Unix; and it isn't a weird decision if you take into consideration of multi user systems in office environments that have non trivial security considerations (for example telecoms companies), which is exactly where Unix came from.

Well, if leaking the length of the password is such a big deal, why not just use a reasonably long password? Moreover, if someone can see the number of asterisks on the screen, what prevents them from seeing the actual keys that are being pressed?

Video cameras are a thing too

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#383

Post by smakt »

Amazing that the peanut gallery of HN dipshits is short-stroking over a full-on LLM-slop shitsite writeup about nothing.

Truly, when anything in Slashdot News (delete delete) "HaCk3R Newz" has more than about 300 comments, I know it will be a merry-go-round of imbeciles regurgitating nonsense. A moronic choir of nobodies singing the same note. This one didn't disappoint.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#384

Post by Wowfunhappy »

tsimionescu wrote: post #355
Wowfunhappy wrote: post #187

Earlier quoted context omitted.

Why is it better to have a nopassword admin account when using a machine remotely? The point of SSH is to resist mitm attacks, right? If someone could watch my keystrokes, I think I'd have bigger problems!

This resists scenarios where the machine you are running SSH from is compromised, and has a keylogger or something similar installed. SSH can't protect you from a local attacker (in fact, the SSH client binary itself could be the compromised part).

If I own both machines this doesn't seem entirely reasonable. (Of course a machine I own could be compromised but again, then I have other problems.)

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#385

Post by anthk »

written-beyond wrote: post #9

The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…

I mostly use Mosh for that.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#386

Post by asimovDev »

amarant wrote: post #221
mbesto wrote: post #170

Earlier quoted context omitted.

The number of times i realized half way that I probably posted the wrong password and so I vigorously type the 'delete' key to reset the input is too damn high

The number of times I've posted my sudo password in a random slack channel instead of my terminal is not very high, but too damn high nonetheless

I have had a similar issue where I thought my computer went to sleep so I start typing my password while the monitor wakes up only to realize that it was only the screen that turned off and the computer was already unlocked so when I hit enter the password was sent into a slack thread or dm instead

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#387

Post by rkomorn »

lxgr wrote: post #252
amarant wrote: post #221

Earlier quoted context omitted.

The number of times I've posted my sudo password in a random slack channel instead of my terminal is not very high, but too damn high nonetheless

The trick is to use a plausible Slack message as your sudo password :)

Did you just type in your password on HN?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#388

Post by neop1x »

dietr1ch wrote: post #278

I like the idea of showing keystrokes, but I think that a 1:1 entry has arguably better alternatives. The default entry on xsecurelock[^0] shows a character jumping on a line between keystrokes, which works well on giving key press feedback while visibly obfuscating password length, ________|_______________________ // after pressing a key it'd move around, ___________________|____________ Also, for anyone looking int…

It would be enough to just show a single character (* or some other to distinguish) if there is something typed in and show no character after using backspace to delete the typed password.

It doesn't make sense to show the exact amount of characters. It just leaks the password length.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#389

Post by trvz »

ghighi7878 wrote: post #116
written-beyond wrote: post #9

The number of times I've been stuck wondering if my keystrokes are registering properly for a sudo prompt over a high latency ssh connection. These servers I had an account setup too were, from what I observed, partially linked with the authentication mechanism used by the VPN and IAM services. Like they'd have this mandatory password reset process and sometimes sudo was set to that new password, other times it was w…

I agree that this move is good. But you should not type sudo passwords on remote machine. Instead setup your machinr to have nopassword for special sdmin account and enable pubkey only authentication.

Real men rawdog with root.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#390

Post by andrewshadura »

b112 wrote: post #230
throawayonthe wrote: post #80

Earlier quoted context omitted.

sudo is from 1980, that's probably what they meant https://www.sudo.ws/about/history/

No, they simply don't understand the history of the very thing they report on. If you look at the quoted text, they easily could have said 'Unix" terminal. They also repeatedly talk about a 'half century' of Linux terminals in other parts of the article. This site seems to cater to Linux specifically in many respects, so it's quite reasonable to call them out on super-simple stuff.

Judging by the style of the tables and the overall sloppiness, it looks like the article was authored using Claude.
Post reply on HN