Comment by gzread

6 months ago

Good. It's terrible UX.

The security argument is a red herring. It was originally built with no echo because it was easier to turn echo on and off than to echo asterisks. Not for security.

23 comments

gzread

Reply
zenethian  6 months ago

You got some sources or did you just make that up?

Because to hell with UX when it comes to security. Knowing the exact length of a password absolutely makes it significantly less secure, and knowing the timing of the keystrokes doubly so.

  • 9dev  6 months ago

    Yet somehow, none of the other high security tools I have ever interacted with seem to do this for some reason. No auditor flags it. No security standard recommends hiding it.

    But SUDO is the one bastion where it is absolutely essential to not offer hiding keystrokes as an obscure config option, but enable for everyone and their mother?

    • creatonez  6 months ago

      And once you start adding these accessibility problems, people will respond by using weaker passwords.

  • baq  6 months ago

    > Because to hell with UX when it comes to security.

    I don’t think you have any idea how wrong you are.

  • plorkyeran  6 months ago

    Bad security UX that results in users bypassing security mechanisms entirely is probably the single biggest source of real-world security problems.

themafia  6 months ago

> easier to turn echo on and off than to echo asterisks.

One implies the other. You turn echo off. Then you write asterisks.

> Not for security.

Consider the case of copy and pasting parts of your terminal to build instructions or to share something like a bug report. Or screen sharing in general. You are then leaking the length of your password. This isn't necessarily disastrous for most use cases but it is a negative security attribute.

  • mikkupikku  6 months ago

    > One implies the other. You turn echo off. Then you write asterisks.

    That's not how it works. Sudo turns off echo but otherwise keeps the terminal in it's normal cooked canonocal mode, meaning sudo only sees what you've entered after you hit enter. To print asteriks as you type requires putting the terminal in raw mode, which has the addition consequence of needing to implement shit like backspace yourself. Still a UX win worth doing, but it's pretty clear that skipping that and just disabling echo is an easier lazier implementation.

    • themafia  6 months ago

      You're correct, but, the echo and canonical mode flags are literally in the same termios structure member. One is no more complicated to change than the other. You can also easily switch to character at a time read() which makes handling backspace, erase or kill exceedingly simple.

      I still doubt the claim the scheme employed by sudo was done because it "was easier."

      1 reply →