Inquirer.js: Password prompt should display no characters

[Asheboy]

Password prompt should display no characters when entering text, or there should be an option to enable this behaviour. This would mimic the behaviour of applications like ssh-add.

[danielchatfield]

This has been discussed before, It adds no security to do this since for someone to see how many asterisks appear then they must be able to observe the screen and thus can see the number of keystrokes pressed. The output is removed when the password entered so they will not appear in any logs.

[Asheboy]

This would not be the case during a ‘screen sharing’ session/recorded screen playback.

[danielchatfield]

Good point.

[timmyg]

anyone know how to hack this together @Asheboy @danielchatfield?

[Asheboy]

You certainly can hack it together by removing https://github.com/SBoudrias/Inquirer.js/blob/master/lib/prompts/password.js#L148-L152. You'd really want to remove that function, alas, I receive an error of which I do not have time to resolve at the moment. I might take another look this evening

[SBoudrias]

You can create a custom prompt and register it on Inquirer so you or other people can use it without hacking Inquirer source in a way that'll be unmaintainable.

[timmyg]

yea ok, I'll mess around with it and hopefully send a PR this weekend or early next week.

[aakilfernandes]

This has been discussed before, It adds no security to do this since for someone to see how many asterisks appear then they must be able to observe the screen and thus can see the number of keystrokes pressed. The output is removed when the password entered so they will not appear in any logs.

@danielchatfield do you have a source on that?