Re: [Edbrowse-dev] masking of passwords

[Adam Thompson <arthompson1990@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1965 bytes --]

On Thu, Dec 17, 2015 at 01:55:16PM -0800, Chris Brannon wrote:
> Kevin Carhart <kevin@carhart.net> writes:
> 
> > I know that at the time I type i2=password,
> > or something, edbrowse
> > has no way of knowing what I want to do next
> 
> Yeah, generally that is true.  However, I've seen programs be pretty
> smart about this.  For example, the IRC client weechat will
> start printing masking characters as soon as you type the string
> /msg nickserv identify
> For those not familiar with IRC, this is often how you authenticate your account,
> by sending a private message to a bot named nickserv.
> We could do that kind of cleverness in edbrowse,
> but I like your "invisible mode" idea.

Doing that would require a change in how edbrowse handles terminal input.
Specifically we currently wait for a line to be entered before we process it,
but in order for such fancy things as i2= to cause imediate password masking
we'd need to process each keystroke.

What I generally do (on linux) is use:
!stty -echo

To enter the password then (quickly):
!clear

To remove the printed line. I suspect displayLine could be altered in
some way to avoid the screen printing,
but I'm not so sure about the non-echoing.
I think that, rather than an invisible mode,
I'd prefer something like a pw command which'd take a field number and then
display a non-echoing prompt, i.e.:
pw2
Password for field 2: <password goes here>

And then have the field print as ... (i.e. for my gmail account this would read):
<arthompson1990@gmail.com> <...>

The reason for the fixed ... is that it means you can't guess password length
(probably rather paranoid). If the field was blank then it would print as a blank field.
If someone used i2 rather than the pw command then the field would still print as ...
but obviously the i2 line would remain both visible and in the readline history
(in readline mode).

Any thoughts?

Cheers,
Adam.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 473 bytes --]