Comment by dietr1ch
6 months ago
I like the idea of showing keystrokes, but I think that a 1:1 entry has arguably better alternatives.
The default entry on xsecurelock[^0] shows a character jumping on a line between keystrokes, which works well on giving key press feedback while visibly obfuscating password length,
________|_______________________ // after pressing a key it'd move around,
___________________|____________
Also, for anyone looking into preserving this last resort obfuscation behaviour you can do it with,
# /etc/sudoers
Defaults !pwfeedback
On NixOS (using sudo-rs),
security.sudo-rs.extraConfig = ''
# NixOS extraConfig
# ===========
Defaults !pwfeedback
'';
I've got to say, if you were able to see me typing, you can probably record me doing so, bug my USB keyboard, or buy a $10 wrench. I guess for people streaming it might be worth it? I don't think it's a big enough deal to warrant the fuss around this change though, it's just an ok UX improvement that could be slightly better at retaining the sense of security.
Actually now that I think about it, showing the entered length is very useful, cause I often find myself entering the wrong password for something else, realizing 2/3 the way through and I have two options: to hold backspace for some random amount of time (usually for not nearly long enough cause there's no feedback as to how many characters remain to delete), or enter the wrong one and wait for the long ass delay to let me do it again.
On some systems I've gone as far as removing that delay. It's either that, reusing the same password everywhere, or losing my fucking mind. This should fix that wonderfully.
Maybe it works for <=10 character passwords, but it seems to me that if you are counting asterisks in a longer password because you lost track of you input, then you are better off using C-u to clear the password and enter it from scratch.
That said, with any feedback that confirms my key was pressed I can pretty much always correct a mistake using backspace without trouble (with backspace also having visual feedback).
Not giving away the length is mainly an assistance to people with really short passwords. Knowing that someone has a 12 character password doesn't help attackers much, but knowing that someone has a 6 character password would be really useful.
It's still not very useful to hide the length. If you don't know the length and just start guessing with passwords of length 0 it only adds about 1/N extra guesses where N is the alphabet size compared to guessing strictly the right length. So it is a very small savings to know the password length.
It might matter a bit more for dictionary-based attacks (you don't have to bother hashing dictionary permutations that don't match the expected length) but I still suspect it doesn't save you much.
That's only for targeted attacks.
For opportunistic attacks, this could help you identify those with short passwords and only attack them. This is a factor of N speedup where N is the pool of people you are interested in attacking.
It would be enough to just show a single character (* or some other to distinguish) if there is something typed in and show no character after using backspace to delete the typed password.
It doesn't make sense to show the exact amount of characters. It just leaks the password length.