Ubuntu 26.04’s Sudo-rs Update Sparks Debate Over Password Visibility
A recent update to the sudo-rs utility in Ubuntu 26.04, designed to improve user experience, has ignited a debate within the Linux community. The change, which enables password feedback (asterisks) by default when using sudo, deviates from the decades-long practice of concealing password input and has drawn criticism from users concerned about security implications.
The Change: From Invisible Input to Asterisks
Traditionally, sudo on Linux systems has not provided any visual feedback while typing a password. This practice aimed to prevent shoulder surfing, where someone looking over a user’s shoulder could potentially guess the password based on its length. However, this lack of feedback often confused new users, who might question whether their input was being registered.
The sudo-rs rewrite addresses this usability issue by displaying asterisks for each character typed. According to a commit message, this change “fixes a major UX pain point for new users.” The developers acknowledge a theoretical security trade-off – exposing password length – but argue that the benefit to user experience far outweighs the minimal security risk. Outside of sudo and login prompts, most password entry interfaces, including those on Linux, already utilize asterisks.
Community Reaction and Concerns
The change has been met with resistance from some users who view the altered behavior as a step backward in security. A bug report filed for Ubuntu 26.04 expressed concern that displaying password length “goes against decades of not echoing the length of the password to shoulder surfers.”
Despite the concerns, Ubuntu developers have indicated that the change is unlikely to be reversed. A representative from Ubuntu acknowledged the change was made to improve user experience and provided instructions on how to disable the asterisk feedback via the sudo visudo command and adding the line “Defaults !pwfeedback” to the configuration file. However, the bug report has been marked as “Won’t Fix.”
Background on Sudo-rs and Ubuntu’s Adoption
sudo-rs is a Rust-based rewrite of the classic sudo utility, aiming to improve memory safety and security. As reported by The New Stack, Ubuntu is the first major Linux distribution to adopt sudo-rs as the default implementation of sudo, in partnership with the Trifecta Tech Foundation.
The move to sudo-rs began with Ubuntu 25.10, which received a fixed version of the utility in November 2025, according to a Reddit discussion. Ubuntu’s decision to adopt sudo-rs was initially announced in May 2025, and is part of a broader effort to enhance the security of core system software through modern development practices, as outlined in a blog post on memorysafety.org.
Key Takeaways
- Ubuntu 26.04 now displays asterisks by default when typing passwords with
sudo. - This change aims to improve usability for new users.
- Some users are concerned about the potential security implications of exposing password length.
- Ubuntu developers have indicated that the change is unlikely to be reversed, but users can disable the feature.
- The update is part of a larger effort to adopt the more secure
sudo-rsutility.