Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

pbxscience.com

Post reply on HN
Print view View original

41–50 of 421 posts

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#41

Post by 9dev »

timhh wrote: post #32

I did this! I didn't actually know that Mint had enabled this by default. That would have been a useful counterpoint to the naysayers. If you want the original behaviour you don't actually need to change the configuration - they added a patch afterwards so you can press tab and it will hide the password just for that time. > The catalyst for Ubuntu’s change is sudo-rs Actually it was me getting sufficiently pissed of…

> If anyone wants to rewrite PAM in Rust... :-D

If you do, offer support for writing modules in a scripting language like Lua or Python. PAM could make it a lot easier to just add OAuth with your company IdP, for example…

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#42

Post by oneeyedpigeon »

gzread wrote: post #30
nananana9 wrote: post #21

Earlier quoted context omitted.

Purpose: > That way you can be certain whether or not you entered a character

And the shoulder surger can still count the number of times it changes so you might as well just be normal. They can also count the number of keystrokes they heard.

Surely looking at your screen seconds/minutes/hours later is the greater risk vector?

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#43

Post by timhh »

yonatan8070 wrote: post #38
timhh wrote: post #32

I did this! I didn't actually know that Mint had enabled this by default. That would have been a useful counterpoint to the naysayers. If you want the original behaviour you don't actually need to change the configuration - they added a patch afterwards so you can press tab and it will hide the password just for that time. > The catalyst for Ubuntu’s change is sudo-rs Actually it was me getting sufficiently pissed of…

Pretty sure the 2s delay is designed to slow down brute-forcing it.

Not for local password authentication.

https://github.com/pibara/pam_unix/blob/master/unix_chkpwd.c...

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#44

Post by oneeyedpigeon »

jadamson wrote: post #28
Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

I don't understand your suggestion. If you're still showing one character after each character entered, what's changed? What's the benefit of having a random character from a random set, instead of just a random character?

I think the idea is that each character overwrites the previous, so you're never showing the total length (apart from 0/1!)

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#45

Post by necovek »

silisili wrote: post #15
pojntfx wrote: post #11

It's fun, leading edge Linux distros (e.g. GNOME OS) are actually currently removing `sudo` completely in favour of `run0` from systemd, which fixes this "properly" by using Polkit & transient systemd units instead of setuid binaries like sudo. You get a UAC-style prompt, can even auth with your fingerprint just like on other modern OSes. Instead of doing this, Ubuntu is just using a Rust rewrite of sudo. Some things…

Ubuntu truly are masters of going all in on being different in a worse way, only to about face soon thereafter. You'd think by now they'd have learned, but apparently not.

Courage to be different is an open door to creativity.

Yes, it means going in a wrong direction sometimes as well: that's why it takes courage — success ain't guaranteed and you might be mocked or ridiculed when you fail.

Still, Ubuntu got from zero to most-used Linux distribution on desktops and servers with much smaller investment than the incumbents who are sometimes only following (like Red Hat).

So perhaps they also did a few things right?

(This discussion is rooted in one of those decisions too: Ubuntu was the first to standardize on sudo and no root account on the desktop, at least of mainstream distributions)

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#46

Post by creatonez »

gzread wrote: post #17
Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

Because that's still weird and confusing to people and still serves no purpose.

Sorta reminds me of the i3lock screen locker. It shows an incredibly confusing circle UI where every keystroke randomizes the position of the sector on a circle, with no explanatory text on the screen (^1). To new users, it's not clear at all that you are entering your user password or even that it's a screen locker at all, because it just looks like a cryptic puzzle.

Of course, once you do understand that it's just a password prompt, it's great. Completely confuses the hell out of any shoulder surfers, who will for sure think it's a confusing puzzle, and eventually they will get rate limited.

^1: Example of it in use: https://www.youtube.com/watch?v=FvT44BSp3Uc

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#47

Post by DrawTR »

jadamson wrote: post #28
Tepix wrote: post #14

Why not just display a single character out of a changing set of characters such as / - \ | (starting with a random one from the set) after every character entered? That way you can be certain whether or not you entered a character but and observer can‘t tell how many characters your password has.

I don't understand your suggestion. If you're still showing one character after each character entered, what's changed? What's the benefit of having a random character from a random set, instead of just a random character?

They mean to have a static single character on the screen and have it change with every keypress. For example, you type "a" and it shows /. You type "b" and it shows "|", etc.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#48

Post by silisili »

necovek wrote: post #45
silisili wrote: post #15

Earlier quoted context omitted.

Ubuntu truly are masters of going all in on being different in a worse way, only to about face soon thereafter. You'd think by now they'd have learned, but apparently not.

Courage to be different is an open door to creativity. Yes, it means going in a wrong direction sometimes as well: that's why it takes courage — success ain't guaranteed and you might be mocked or ridiculed when you fail. Still, Ubuntu got from zero to most-used Linux distribution on desktops and servers with much smaller investment than the incumbents who are sometimes only following (like Red Hat). So perhaps they…

Ubuntu became the most used because they were the first to really dumb down the install process. No insult intended, it was my first distro as well. If you weren't around, it was rather stark. Most others had install media that just loaded a curses based install menu, asking you about partioning. Ubuntu gave you a live environment and graphical installer, which didn't ask any hard questions... way ahead of their time.

Nobody picked Ubuntu because of Mir, or Compiz, or Upstart(or snaps, while we're on the topic). They were obvious errors. That it's popular doesn't negate that fact.

Re: Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords

#50

Post by jadamson »

oneeyedpigeon wrote: post #44
jadamson wrote: post #28

Earlier quoted context omitted.

I don't understand your suggestion. If you're still showing one character after each character entered, what's changed? What's the benefit of having a random character from a random set, instead of just a random character?

I think the idea is that each character overwrites the previous, so you're never showing the total length (apart from 0/1!)

Ah, and the characters are supposed to be an ASCII spinner.

I think if I was new to Linux that would confuse the life out of me :)

Post reply on HN