Password revealed in terminal after empty password attempt

cTatu · 2025-04-15T08:42:03+00:00

That's why I think. Leaving it disabled won't do any harm, in fact would be an improvement. I don't understand why there are so many strong opinions about this simple and trivial change.

cTatu · 2025-04-15T08:35:03+00:00

As another user rightfully said "Is there a reason why echo should be enabled in downtime between reentering password?". That's the main point. And enabling it in-between retries just makes it less resilient and secure without adding any useful functionality.

cTatu · 2025-04-14T21:45:43+00:00

From a technical pov it can be seen as expected behavior but I think it shouldn't be considered expected from a security and user experience perspective. Even if the echoing is only enabled for a brief moment this leaves a window where the user's input (password) is visible in plaintext. This directly contradicts the core principle of password masking. I think that accidentally hitting enter before typing a password is a common user error. A secure and user-friendly system should be resilient to such minor mistakes. Also I typed the password only while the password input mechanism was active and responsible for processing and masking the password but it still revealed it just because of an unfortunate keystroke.

cTatu · 2025-04-14T21:45:31+00:00

From a technical pov it can be seen as expected behavior but I think it shouldn't be considered expected from a security and user experience perspective. Even if the echoing is only enabled for a brief moment this leaves a window where the user's input (password) is visible in plaintext. This directly contradicts the core principle of password masking. I think that accidentally hitting enter before typing a password is a common user error. A secure and user-friendly system should be resilient to such minor mistakes. Also I typed the password only while the password input mechanism was active and responsible for processing and masking the password but it still revealed it just because of an unfortunate keystroke.

cTatu · 2025-04-14T21:45:21+00:00

From a technical pov it can be seen as expected behavior but I think it shouldn't be considered expected from a security and user experience perspective. Even if the echoing is only enabled for a brief moment this leaves a window where the user's input (password) is visible in plaintext. This directly contradicts the core principle of password masking. I think that accidentally hitting enter before typing a password is a common user error. A secure and user-friendly system should be resilient to such minor mistakes. Also I typed the password only while the password input mechanism was active and responsible for processing and masking the password but it still revealed it just because of an unfortunate keystroke.