Slashdot Mirror
Fedora 19 To Stop Masking Passwords
First time accepted submitter PAjamian writes "Maintainers of the Anaconda installer in Fedora have taken it upon themselves to show passwords in plaintext on the screen as they are entered into the installer. Following on the now recanted statements of security expert Bruce Schneier, Anaconda maintainers have decided that it is not a security risk to show passwords on your screen in the latest Alpha release of Fedora 19. Members of the Fedora community on the Fedora devel mailing list are showing great concern over this change in established security protocols." Note: the change was first reported in the linked thread by Dan Mashal.
... thinking they know what is best for everybody. Same stupid story again and again. A button or hot-key for those that want to see their passwords would be acceptable, but making it the default is not.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It's only in cleartext during installation, and only while the password field has focus. This is hardly something to get up in arms about, unless you regularly re-install your OS in front of a crowd.
#include <sig.h>
Obligatory bash.org quote
CC.
TaijiQuan (Huang, 5 loosenings)
I like the way Windows 8 addressed this problem. They added a button that looks like an eye on the right hand side of the password field to show the password as you've typed it. That seems like a better compromise than briefly showing the password characters.
What exactly are you supposed to do when you're demoing a product to a room full of people and need to log in using your credentials while they watch? Happens to me all the time.
I think that this improves password usability and is a move to the right direction. Others should follow instead of making passwords even harder for the end users, the most insane counter examples are the websites that mask your username as well. However, there really should be a switch to toggle this behavior.
This
1. Apps should be aware of password entries, and should turn of mirroring monitors, projectors etc. during password entry.
2. Showing nothing of the password is bad. Some applications actually added random numbers of stars as you type, that is worse. Showing a single character is slightly useful. Dimming out a few characters is better.
3. People are very good at detecting that someone is looking over their shoulder.
Stupid developer not owning up to his mistake
I hope it catches on. Just give me a tickbox if I want masking when in a public place.
"Be nice, veer left, and never stop thinking" Iain Banks - Walking On Glass
So when I type 'password' for my password it will show it. Great news!
I predict Ubuntu will release their own update that incorporates this.
And then we can all get along with the business of running Debian - who would never be so stupid as to pull crap like this.
The log-in and sign-up pages on Phil's Hobby Shop have a "Show password as I type" checkbox. Is this what you were looking for?
Many times I'd like to see my password in clear text (like when entering new passwords, to make sure they're correct). It would be convenient to have some way to temporarily turn off asterisk masking.
Put my fist through my alarm clock with its ding-dong death inside my ear. - The Blackjacks.
my password is '*********' so there will be no change for me
Password masking becomes increasingly annoying with password length, since any finger fumble becomes nearly impossible to back out with the correct number of backspace presses.
I could live with a masking system that replaced the usual * with a - when the current symbol is from the same symbol set as the previous symbol.
The password in the first line would display with the following mask.
ima6uldv8!!!
*--**---**--
For myself anyway, that would put the backspace key "back on the menu" after a finger blap.
I'd be totally happy if the enhanced unmasking only kicked in after the first eight characters.
I don't know my passwords, only my fingers do, they are too difficult to remember. I don't see how plaintext should help me typing them, even if I knew them, they contain several combinations of similar looking characters and numbers, so it would be more distracting to look at what I am typing. It's like the keyboard, what's written on the keys disturbs more than it helps.
Regardless of whether an idea is good or bad, you should not change decades-old conventions lightly. The proper thing to do at this time is to mask by default and have a checkbox nearby that lets the user choose to show the password.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
We're in the age of "loudest designer/developer wins - and to hell with the consequences of actual usability"
I need some of the upstream stuff for what I do. So, I upgraded to F18 (PAE). ...until I updated to the latest KDE. Now, everything freezes briefly when a
The experience has been mostly what I've expected with silly things broken:
LVM + LUKs doesn't boot, gnome-terminal auto-resize to nothing in KDE,
pulseaudio's clicks/pops (even with load-module module-switch-on-port-available
commented out), terrible, terrible installer. But the core stuff of KDE seemed
pretty okay.
windows focus changes, what was once very smooth motion is now jerky and stuttery.
It's like the Fedora project is beginning to implode on itself. No regression testing,
no thinking about how a feature impacts other systems, and so on.
I honestly can't see any reason/value why the password's visibility had to change.
How about making the installer more robust instead of doing non-value-added things
like this and calling them features?
and uhm. yeah. i mean. there is just no other way to describe it.
In some environments, security is an issue. If it's network installable, then chances are they can get the kickstart/unattend/whatever file off the network. For most linux envs done right, the risk is disclosure of the /etc/shadow variant of the file severely mitigating the risk, but in Windows, you cannot use any sort of meaningful protection.
If you do it from stock media, policy may still prevent it from containing the media (e.g. high chance the technician won't take extra care and might lose media with sensitive data).
There are environments that automate everything else except the local administrator passwore. There are very few autoinstall mechanisms that meaningful protect the password across deployment (e.g. the Flex System Manager from IBM does it for the OSes it can deploy, and you can craft a Windows install scheme that has no usable local accounts and relies entirely upon active directory sacrificing the ability to administer it offline, but overwhelmingly the majority of automated OS deployments will leave passwords vulnerable if they are tasked with setting them.
XML is like violence. If it doesn't solve the problem, use more.
Not only Shoulder surfing, but also security cameras.
It would not be nice if I go to Internet cafés, and the web form will show to all people my passwords in clear.
Schneier now backs an approach taken by BlackBerry devices and iPhones, which display each character briefly before masking it.
That is not good with security cameras or other cameras, like web cameras, or mobile phone cameras, which are quite common in public places like Internet cafés.
PS: I referring to the article of Bruce Schneier: http://www.out-law.com/page-10152 not the article about Fedora. I know that it's very uncommon to install Fedora in public Internet cafés.
http://www.mueller-public.de - My site http://www.anr-institute.com/ - Advanced Natural Research Institute
Few times I have installed OS with wrong keyboard layout. This is not big problem normally. But when you switch your layout after install. You better to remember run passwd too. At least if you have many special characters in your password. Luckily I had one root shell open both times. Visible password would have prevented this close call.
Don't we always say here, "obscuring is not securing"?
Back in the pre-historic days of computing, you had a "terminal" and this thing lived basically in front of everybody because you had to share it. That's why password fields started showing up masked. There were too many people around and it was difficult to cover up your password. This is no longer the case and this change is the first step I've seen on an OS that recognizes this practice is no longer needed.
This is a solved problem on Android.
I've noticed some apps have a "Show Password" checkbox so the user can choose.
Or they show the last character typed for about 2 seconds before changing it to an asterisk.
Either way is superior to always showing the password or asterisks.
My anaconda don't want none unless it's not masked son!
"... decided that it is not a security risk to show passwords on your screen in the latest Alpha release of Fedora 19 ..."
Security risks is not something that can be "decided" by somebody. There are always risks and showing the password on plain text is certainly more risky than masking it. Or are there some really awesome benefits for showing them in plain. No. Because noone expects that, so both usability and security suffer.
Password: [_________] (text)
Confirm: [_________] (text)
Mask/Unmask Password [X] (check box)
Everyone is happy.
~~ Behold the flying cow with a rail gun! ~~
Because all the time the Linux distributions waste on crap seems to indicate so. Are they bored out of their mind that they need to focus on stupid things?
none
If you don't want to see your password, just close your eye, doh!
got it
He is a non-expert on Crypto who wrote a book that no experts on Crytpo would publish over a decade ago. Since that time he's spent a lot of time blogging about a lot of stuff.
He has almost no credentials to make him a security expert. He's another Kevin Mitnick. Can't the Slashdot community come up with real, credentialed security experts to rely on?
In case I get it wrong, the computer reminds me by saying, "Your password is incorrect".
I don't know if you are sarcastic or not, but I for one am thankful for the maintainers of Fedora. Hear me out...
These days I have to type in passwords that are akin to random letters. I am ok with that. BUT it is BLOODY EFFEN HARD to type in the password into the text field. And if the text field hides the text it becomes annoying to have to input the data again. The problem is that I know my keyboard, but sometimes I have to type twice to hit the correct %^*( character. If I am looking at the keyboard and the screen at the same time things become confusing. Doing this two or three times becomes a royal pain in the arse!
I understand WHY you should not do this, but quite frankly there is theory and there is practice. And in an era of long obtuse passwords I am thankful!
"You can't make a race horse of a pig"
"No," said Samuel, "but you can make very fast pig"
Who cares really. It's funny that even the commenters here on Slashdot seem so up and arms, so offended, over such a small thing. It doesn't really matter, trust me, it really doesn't.
It's about time people started challenging these "established security protocols"...
Ask yourself what benefit does masking the password bring vs the detriment of doing so.
Benefits:
If someone is looking over your shoulder they won't see the password on screen.
Detriments:
If someone is looking over your shoulder they can watch what keys you press anyway, significantly reducing the above benefit. Looking at the keys is actually easier as the keyboard is usually visible from a greater viewing angle and greater distance.
You are more likely to make errors, especially when typing on a keyboard you aren't used to or which may not be configured correctly (eg wrong keymap, you tried to type one character and got another but you typed the same character both times so the system accepted your input).
If there is noone untrusted looking over your shoulder then there are no benefits at all.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
If you are following standard security protocols. Most people are up in arms about this in the work place, but if you are following standard protocols at a work place, then it would not matter. An OS is always installed in a non-production network, with a different root password (typically the development network root password as it is distinct from production). Then the new OS is patched, configured with check lists, connected to LDAP servers (or what ever connections you need). The last three steps are to change the static IP to the new production network, Change root password to production root, and shut down the server. Then it is re-patched on the production network and when it comes up, it is secure, and only the admins know the root password.
They let you press and hold Insert to view masked passwords during install and when passwords are like WiFi PSKs...
Default to masked, hit ctrl and it toggles to unmasked. Ctrl while unmasked makes it masked again.
I am very small, utmostly microscopic.
the next generation of users will be spared fun.
yours sincerely hunter21
FTA:
"So was I wrong?" wrote Schneier. "Maybe. Okay, probably."
Check your ego and stop waffling. If you're wrong, say you're wrong. Not maybe. Not probably. Just wrong.
First, Gnome goes down the toilet. Now, it appears that Fedora is next. Why do developers always think that they know better than the user? :(
I propose that many accounts can be cracked by using Google Glass and observing people inputting to the keyboard. Actually I can do it in my head now, but Google Glass opens new territory.
hunter2
This is a good case for, as suggested by many in the discussion, a "show password" button, as is widely used. I don't see an argument for making it the default.
... because when I set my password I want it to be correct which is way easier to verify when I can read what I type (and I usually don't set passwords when people are watching). Password prompts when you have to enter a password are a totally different story.
If I am in a public place, installing a new version of Fedora xx. I see no problem with showing the root password within the Anaconda installer. I always force a very simple one. It is immediately after a successful boot of Fedora, that I enter as "root", and I change the password to something other. Immediately after the password change I usually revise sudo commands (visudo) to accept "wheel" group with/out password. I also verify that I have at least one administrator logon, other than root and he is a member of the "wheel" group.
So, no big deal. If the root password is shown during installation, then change it immediately after a successful boot of the new system.
The original text says installer. For the installer where tha password has been typed only once.... sure!
Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities; Truth isn't. Mark Twain.
1) - Masking the password on the screen is UTTERLY USELESS unless you also have a towel or something draped over the keyboard. It's far easier for a touch-typist to figure out what someone is typing by looking at the keyboard (even from across the room) than it is to make out tiny letters on a typical crappy DC monitor from off-angle or at a distance
2) - If your monitor is facing in ANY direction but at a blank wall or the adjacent row of racks, you're doing it wrong. Always position yourself with your back to the wall, no matter where you are. Situational awareness is always important for one reason or another and it's much more difficult if you don't have control of your 6 o'clock.
Nothing worthwhile ever happens before noon
It's about time some of these security-by-rote rituals were challenged and changed or abolished. They may appear to be making things more secure, but sometimes the actual effect is the opposite, like insisting on ridiculous password policies. For the topic being discussed, I've had to reduce the strength of a friends wi-fi password as it was almost impossible to enter a long complex string correctly on a variety of devices, some with horrible UIs, when you couldn't even see if what you were entering was correct. In this case making visibility an option seems best.
sometimes I have to type twice to hit the correct %^*( character
Why are you using those in passwords? Just make it longer. Remember, if you have to hit the shift key, you could type two characters instead and have a far stronger password.
Because many organizations have weird and bizarre rules for passwords that are not based on actual truth of what makes a secure password. My current favorite is 16! Characters, no words, at least 2 each of special characters, numbers, lowercase and uppercase letters. i.e. so long that NO ONE can remember the things if they're truly randomized. Although they're supposedly switching that particular circumstance over to token-based.
Wow, I did not ex
I don't know if you are sarcastic or not, but I for one am thankful for the maintainers of Fedora.
These days I have to type in passwords that are akin to random letters.
I get more annoyed with sites that *wont* let me us @#$%* chars, enforcing only [A-Za-z0-9].
I am ok with that. BUT it is BLOODY EFFEN HARD to type in the password into the text field. And if the text field hides the text it becomes annoying to have to input the data again.
I always compose the new password in my management tool then cut/paste into the text field. Doesn't everyone?
There is a dumb-ification process in IT that I can't explain. All the things that worked get replaced by dymbed down version because a developer/design does not have a use for it, thought it was cool, whatever...
My current favorite is 16! Characters...
I initially read that as 16 factorial. That's a long password... http://www.wolframalpha.com/input/?i=16+factorial
My current favorite is 16! Characters
By the time you finished typing it the first time, I bet your beard grew more than ten meters!
This is a UDP joke, I don't care if you get it or not...
https://git.fedorahosted.org/cgit/anaconda.git/commit/?id=da565b769979a031f318dbc727b9888e4f1fb37c
"Revert "Add signal handlers for controlling password entry visibility." (#958608)."
I understand WHY you should not do this, but quite frankly there is theory and there is practice. And in an era of long obtuse passwords I am thankful!
It's better when you work internationally. Our standard desktop admin password contains an @ sign. Which in most counties is shift-', but in the u.s. it's shift-2. It's not obvious which keyboard layout is in place (you also have to type user@domain, rather than domain\user, as \ doesn't exist as any key on the physical keyboard-mapping we have)
Password theory tells me that
Pa55word!
Is an awesome password. 9 characters, capital, lower case, numbers and symbols.
It also tells me that
thisismyverylongandeasytorememberpassword
is rubbish, (or to be exact, "really good, if you put in a random symbol numbers and capitalise some letters")