6

There is a command-line application that interactively prompts you for your password to a third-party service. Whereas e.g. sudo completely hides your input as you type your password, this application prints * for each character you type.

For a command-line application, does the act of masking a password pose any more security risks than completely hiding input? In other words, would there be any compelling security-related reason to refactor this application to hide input?

11

sudo does not hide input completely because of an alleged security benefit, but because it is much simpler to do in the context of a Unix terminal. A Unix command-line application normally receives user input by whole lines (nothing is sent to the application code until you press the "Enter" key); hiding the input is only a matter of telling the terminal not to display the typed characters, with a tcsetattr() call (e.g. see this answer). To display stars for each entered character, sudo would have to do some more complicated things, i.e. set the terminal in "raw" or "cbreak" mode (see this page for some details); sudo would then have to implement line-editing itself (handling of backspace key, or Ctrl-U to clear the complete input, for instance).

Although completely hiding the input hides the password length, this information is still available to bystanders, who can use their ears instead of their eyes: instead of counting the stars on the screen, they can count the key presses. Therefore, the alleged security benefit of complete hiding would be, at best, very slight.

Displaying the stars makes a much better user experience, in particular people with slightly flaky keyboards, where a keypress can be "lost", or else involuntarily duplicated.

  • +1, though I think a skilled shoulder-surfer pitted against a quickly typed, long password on the command-line would have better luck against the visual asterisks (because monospaced terminals give a trained eye some other helpful queues), than against the drone of a password quickly input from muscle-memory. I have several passwords in the 30+ character range committed to muscle memory, and when I type those in, sure you technically hear keyboard clicks individually, but really it's more of a merged staccato drone. Yet the line above that in plain text might serve as a nice length measure. – mtraceur Dec 2 '16 at 5:48
3

The only improvement that comes to mind about completely hiding input is that the password length is hidden from shoulder surfers as well.

Given how unlikely the possibility of guessing even a weak 5-6 alphanumeric password by hand in a sane amount of time, there probably isn't any point in changing your application to hide password input instead of just masking it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.