2

I often SSH into a machine and use sudo on it. When entering passwords, I'm always afraid that another window will steal the focus. However, I don't want to display asterisks (with pwfeedback, for example) because that would reveal the number of characters.

Is there a tool available that could give a visual feedback for every character entered, without revealing the number of characters typed? Something like a pipe that rotates on key presses? Basically, anything that moves on key presses would be fine.

In my particular case, this tool would need to work with both SSH and sudo. The target machine is running Ubuntu 15.10. I'm usually SSHing into it using putty from Windows 10.

5
  • @techraf I would normally prefer not showing any information about my password. However, in this particular case, I'm more concerned about typing my password in the wrong window than someone looking over my shoulder. I was trying to to compromise: visual feedback that would be difficult to utilize to gather information.
    – isanae
    Commented Apr 25, 2016 at 2:17
  • pwfeedback solves this problem for you, what you have already noticed in your question. Why did it became a main point again?
    – techraf
    Commented Apr 25, 2016 at 2:21
  • 5
    Any password you use should be strong enough so that the knowledge of its length does not influence the security. Trying to hide this information by subverting native mechanisms that software offers is counterproductive and decreases security.
    – techraf
    Commented Apr 25, 2016 at 2:26
  • If you want to be safe from eavesdropping and shoulder-surfing, perhaps using passwords which change all the time would be better; something like HOTP or TOTP tokens using LinOTP... That way even if another window grabs the focus and your password ends up on IRC (or wherever), it doesn't matter quite so much. Commented Apr 25, 2016 at 4:39
  • By the way guys, I really appreciate the security lesson, but I'm really curious to know if this is possible.
    – isanae
    Commented Apr 26, 2016 at 13:57

2 Answers 2

0

Giving visual feedback for every character entered would by definition reveal the number of characters typed, so by that metric, no, there is not a way to simultaneously do a thing and not do it.

3
  • Uh, okay. I thought having some sort of animation like a spinner that would animate on key presses would be good enough. I guess you could count the number of rotations, but I wouldn't mind. Or maybe displaying a random amount of stars for each key. Does that make more sense?
    – isanae
    Commented Apr 25, 2016 at 1:47
  • 1
    Then I just need to count how many times I see asterisks appear.
    – DopeGhoti
    Commented Apr 25, 2016 at 1:53
  • Sure. I'm not exactly Edward Snowden here, so I'll be fine as long as 1) something tells me I'm actually entering characters and 2) the resulting output has no correlation with the password length.
    – isanae
    Commented Apr 25, 2016 at 1:54
0

Not sure if this can be used by sudo (probably yes, somehow) and it requires X display:

enter image description here

Certainly it works with ssh as demonstrated on the picture above. It is taken from Fedora, but I hope other distros have something similar.

2
  • I mentioned in the question that I'm using putty on Windows 10, so X isn't easily available to me.
    – isanae
    Commented Apr 25, 2016 at 14:57
  • There are also X servers for windows ...
    – Jakuje
    Commented Apr 25, 2016 at 14:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .