Posted by akersten 18 hours ago
And yes, it remember how many it echoes so backspace works correctly.
A space with a cursor instead of an asterisk would make it harder to count the Chars
Adding a random 1 to 3 output chars instead of one would obfuscate this even more.
A delayed output could make you submit the password prompt before showing anything.
A single asterisk that switches back to space after 250ms inactivity may even be better.
I don't know, but somehow this feels underthought even if it probably is not. Simple is probably the best approach
Users expect to see exactly 1 new char (either the key pressed or an asterix) when they type something. Seeing up to three chars appearing or disappearing after some time imho is worse than what we have today.
Is it usable now? Do all utilities support all of GNU's features (or most)?
There is a list of open items here, it's looking pretty good tbh: https://github.com/orgs/uutils/projects/1
It's on brand for Ubuntu, though. They've been looking for an audience that is not me for a very long time. I sometimes worry about Debian's resistance to social pressure, though. It seems that Debian doesn't fall for marketing or corporate pressure, but they sometimes fall when they are surrounded by people who have fallen for marketing or corporate pressure.
The correct change would be leave the default and put in the visudo file for easy uncommenting. The "developers opinion" is flat wrong.
# uncomment below to see *s when typing passwords # Defaults pwfeedback
All of the dev thinking on the matter is based on narrow use-cased "if you're on a a host where login to a login screen and people can see you... "
When users connect via ssh keys to production hosts and type sudo passwords, I do not one iota of potential security benefit lost.
I don't really want to just disable passwords. I recall that causing technical pains. And this is a desktop PC in my home office and I'm just generally okay with the associated security risks.
You could probably throw together a quick PAM module that scans for your phone's presence. But, aside from the security/spoofing risks, Bluetooth scanning can take half a minute even when you have the device set to be discoverable so you may be faster off typing in your password.
Alternatively, you could just disable the password prompt for sudo if you make sure to always lock your screen. Or not even that if you don't have disk encryption enabled, as anyone with malicious intent can do anything to an unencrypted laptop anyway.
I always thought it was annoying anyway.
