login will show unmasked password if user types too fast on a slow system

Bug #1698604 reported by Alexandre-Xavier Labonté-Lamoureux
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
shadow (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

At the login, from the terminal, the user must login using his username and password.

The program first displays "<host> login:", then the user enters his username. Once the user has pressed "enter", he must enter his password. The user may type too quickly before "Password:" appears and thus what he types before "Password:" was displayed will appear on the screen.

This occurs when the computer is slow when verifying the login username. Users that are used to fast computer will start typing right their password right after pressing "enter" and the characters will appear on the screen.

The result would be something like this:
============================================
Ubuntu 16.04.2 LTS computername tty2

computername login: myusername

mypPassword:

============================================

People who may look at my screen will see that my password starts with "myp". The other characters typed after that "Password:" was displayed are invisible.

The solution would be to make every characters that are typed after the user has entered his password invisible. It could also be a good idea to give the user a sound cue (a PC speaker beep) when he enters a character in the case where he starts typing his password too fast.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in shadow (Ubuntu):
status: New → Confirmed
Revision history for this message
Springnuts (simon-springnuts-orangehome) wrote :

Just had this when updating Ubuntu via the terminal - first three characters of sudo password displayed on terminal (where the green blob is on the photo).

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.