Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is a command-line application that interactively prompts you for your password to a third-party service. Whereas e.g. sudo completely hides your input as you type your password, this application prints * for each character you type.

For a command-line application, does the act of masking a password pose any more security risks than completely hiding input? In other words, would there be any compelling security-related reason to refactor this application to hide input?

share|improve this question
up vote 8 down vote accepted

sudo does not hide input completely because of an alleged security benefit, but because it is much simpler to do in the context of a Unix terminal. A Unix command-line application normally receives user input by whole lines (nothing is sent to the application code until you press the "Enter" key); hiding the input is only a matter of telling the terminal not to display the typed characters, with a tcsetattr() call (e.g. see this answer). To display stars for each entered character, sudo would have to do some more complicated things, i.e. set the terminal in "raw" or "cbreak" mode (see this page for some details); sudo would then have to implement line-editing itself (handling of backspace key, or Ctrl-U to clear the complete input, for instance).

Although completely hiding the input hides the password length, this information is still available to bystanders, who can use their ears instead of their eyes: instead of counting the stars on the screen, they can count the key presses. Therefore, the alleged security benefit of complete hiding would be, at best, very slight.

Displaying the stars makes a much better user experience, in particular people with slightly flaky keyboards, where a keypress can be "lost", or else involuntarily duplicated.

share|improve this answer

The only improvement that comes to mind about completely hiding input is that the password length is hidden from shoulder surfers as well.

Given how unlikely the possibility of guessing even a weak 5-6 alphanumeric password by hand in a sane amount of time, there probably isn't any point in changing your application to hide password input instead of just masking it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.