When users are entering a new passphrase somewhere, it's helpful to provide feedback on the number of characters received by the system.
In a user experience (UX) test I just ran, my user created a passphrase in her password manager, and then attempted to paste it into the new passphrase prompt in the terminal. But because there's no feedback provided on the current system (i.e. the cursor doesn't show entered dots), it wasn't obvious that the paste didn't work.
So from a UX perspective, it would be better to show some dots so users would be aware of what characters actually came in.
Could this feedback decrease security in any significant way? Obviously, it would give shoulder surfers the length that could be used to narrow an attack scope, but I'm hoping the impact is minimal for the better UX.
To provide some context, this if for the terminal command-line interface (CLI), specifically interactive input prompts in Ansible. It provides no feedback right now, but I was thinking about opening a feature request to do so, and was wondering about the security implications.