upvote
Either way, password lengths are exposed in virtually all scenarios except the Unix Terminal - and have caused 0 issues in practice. The default of hiding password inputs really is useless security theater, and always has been.

The crazier part is Ubuntu using a pre-1.0 software suite instead of software that has been around for decades. The switch to Rust coreutils is far too early.

reply
> and have caused 0 issues in practice

Do you have some data to back that up? Because I doubt it’s literally 0. I make this point because we shouldn’t talk about absolutes when discussing security.

Fo example, Knowing a password length does make it easier to crack a password. So it’s not strictly “security theatre”.

So the real question isn’t whether it has any security benefit; it’s more is the convenience greater than the risk it introduces.

Framing it like this is important because for technical users like us on HN, we’d obviously mostly say the convenience is negligible and thus are more focused on the security aspect of the change.

But for the average Desktop Ubuntu user, that convenience aspect is more pronounced.

This is why you’re going to see people argue against this change on HN. Simply put, different people have different risk appetites.

reply