News for hackers. Stuff that matters.
Re:Looks like you are typing while in full screen by toxik on Saturday April 24, 2021 @03:29PM (#26927621)
Which is a good reminder that password entry is terrible security wise. With macOS, you can sudo authenticate with your Apple Watch, which is really nice.
Re:Looks like you are typing while in full screen by majewsky on Saturday April 24, 2021 @03:46PM (#26927745)
If you're concerned that a script's root password prompt may be a forgery, you can run "sudo -v" before executing the script.

For background, there is a convenience feature in sudo: It only requires your password prompt if you have not had a successful sudo invocation in the same terminal in the last X minutes (5 minutes, I think? not sure on the exact value). "sudo -v" is a special invocation which does not actually execute any command, but it renews your 5-minute lease. ("sudo true" is effectively equivalent, though not idiomatic.)

So if you're executing a short script that needs sudo, run "sudo -v" before running the actual script. Then you know that if a root password prompt pops up again, it's not really sudo who's asking.

Re:Looks like you are typing while in full screen by gruez on Saturday April 24, 2021 @04:09PM (#26927912)
> If you're concerned that a script's root password prompt may be a forgery, you can run "sudo -v" before executing the script.

The bigger problem is that even without sudo or your root password, malicious scripts can do a lot of damage. ie. they can add a fake sudo to your .profile, so you next time you try to do "sudo -v" your password still gets stolen.

Re:Looks like you are typing while in full screen by jereees on Saturday April 24, 2021 @04:35PM (#26928081)
Is this a feature built in into the OS? I have only heard of some third party code to allow that…
Re:Looks like you are typing while in full screen by toxik on Sunday April 25, 2021 @06:32AM (#26931687)
It's not built-in for sudo, which is surprising. It is however for many other authentication prompts.