How can I CTRL^C out of a password prompt?

You can CTRL-D su's prompt.
This shortcut signals an end-of-file on the console, quitting the prompt; the console will display Authentication error, which is expectable.

su is running with elevated privileges, and you are not seeing it respond to ^C (which sends a signal with your privileges). You could su to another shell and kill it from the other shell. Also (depending on the system), it might respond to SIGHUP (a hangup signal) if you closed the terminal session where the awkward su is in progress.

There's more than one way that su can ignore your ^C, e.g.,

• establishing signal handlers or
• running under a different controlling terminal.

A quick read of Debian's su seems that it uses the latter. Your system of course may be different.

Further reading:

• /bin/su no longer listens to SIGINT!
• how to terminate some process which is run with sudo with kill

I've found the best way to kill su during entering of an incorrect password is Control+U followed by Control+D. This should avoid annoying delays. You can also just clear the input with Control+U and re-try typing the password in.

Control+U is a command that clears the current line of text, and also works in a shell (and probably other places too). It's also nice that it seems to work with su to clear the currently-entered password.

Using Control+C doesn't seem to work, it appears that for some reason su just ignores it. It is untrue that the user who started the process can no longer kill it because of setuid -- su dies perfectly fine if you kill it with SIGTERM or SIGQUIT from another terminal (as a user that started it). SIGINT doesn't work, so su probably just ignores it.

Control+D with an empty password input seems to be the only way to instantly kill a running su - if any text is entered, then hitting Control+D will induce a 3-second delay (unless you've actually typed in the correct password, in which case... it'll start a root shell).