FS#30976 - [initscripts] '*' shown when typing in passwords

Attached to Project: Arch Linux
Opened by erdbeer (erdbeer) - Thursday, 02 August 2012, 13:07 GMT
Last edited by Dave Reisner (falconindy) - Thursday, 02 August 2012, 17:13 GMT
Task Type Bug Report
Category Packages: Core
Status Closed
Assigned To No-one
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
I recently switched to the new crypttab file format. When booting Arch, I was asked for the encryption passwords, as usual. However, when I typed them in, for each typed character a * was shown. I consider this a bug. There's a good reason why programs like su don't do that.

Additional info:
initscripts 2012.07.5-1
systemd-tools 187-4
This task depends upon

Closed by  Dave Reisner (falconindy)
Thursday, 02 August 2012, 17:13 GMT
Reason for closing:  Duplicate
Additional comments about closing:   FS#30779 
Comment by Dave Reisner (falconindy) - Thursday, 02 August 2012, 13:20 GMT
From systemd-ask-password(1)

"If a password is queried on a tty the user may press TAB to hide the asterisks normally shown for each character typed. Pressing Backspace as first key achieves the same effect."
Comment by erdbeer (erdbeer) - Thursday, 02 August 2012, 13:44 GMT
How could I have known that? And can users really be expected to remember that when other persons are around?
Comment by Dave Reisner (falconindy) - Thursday, 02 August 2012, 14:00 GMT
"Traditionally", programs haven't shown asterisks for passphrases because it's not trivial to get right. It's easier to simply ~ECHO. Regardless, there's now _tons_ of programs where some sort of filler char is displayed including but not limited to:

- display manager logins
- gpg password agents
- <form type=password> fields in every browser I've ever used

Programs like sudo, su, login are becoming the exception, not the rule. I suspect you'd remember to press tab or backspace just like you remember the first character of your passphrase. If you're going to be this level of paranoia, I suggest being more careful when people are around. I'd be far more concerned about people seeing _what_ you're typing, not just how many keys you pressed.

Loading...