Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords. Starting with the upcoming LTS release, every keystroke at a sudo password prompt will echo an asterisk — a small UX fix that has ignited one of Linux's fiercest debates in years.

Comments

  • sik0fewl@piefed.caEnglish
    7·
    2 days ago

    “Security is theoretically worse since password lengths are exposed to people watching your screen, but this is an infinitesimal benefit far outweighed by the UX issue.”

    — SUDO-RS UPSTREAM COMMIT MESSAGE, ENABLING PWFEEDBACK BY DEFAULT

    Do people actually struggle with this, UX-wise? I find that I mistype my password just as often whether or not it is silent or asterisks.

    • TrickDacy@lemmy.worldEnglish
      10·
      2 days ago

      I have many times accidentally pressed a single key and then had to start over because I had no feedback to confirm it’s only one accidental key press.

      • Martineski@lemmy.dbzer0.comEnglish
        8·
        2 days ago

        I also hold the backspace for a (relatively) stupid long amount of time when I do know I made a typo because of no feedback on that either. Lol

        • rbosEnglish
          5·
          2 days ago

          Ctrl-U clears the line.

        • TrickDacy@lemmy.worldEnglish
          2·
          2 days ago

          Yep. I either do that or Ctrl-C and run the command again. I think many of those will be avoidable with feedback

    • Flipper@feddit.orgEnglish
      4·
      2 days ago

      The first time i came across a sudo prompt i thought i didnt work. Yes. I think its bad for new comers.

      • sik0fewl@piefed.caEnglish
        1·
        2 days ago

        Ha. Didn’t even think of that. It definitely used to be a more common pattern.

  • apftwb@lemmy.worldEnglish
    2·
    2 days ago

    If a malicious actor being able to see your terminal is part of your threat model, then remove pwfeedback from the sudoers file.

  • LouNeko@lemmy.worldEnglish
    31·
    2 days ago

    I always thought this was a security feature. Guessing a password that you don’t know the length of is a lot harder.

    • TrickDacy@lemmy.worldEnglish
      7·
      2 days ago

      That is the reason for it. But I think people are finally admitting the scenarios where it actually helps security are exceedingly rare.