PasswordMaker Forums

Other Editions => Other Editions - Feature Requests / Enhancements => Topic started by: lewk on April 22, 2007, 08:56:15 AM

Title: Don't echo Master Password in command-line tool
Post by: lewk on April 22, 2007, 08:56:15 AM

This has probably been brought up before, but I don't know of any reason why the command-line tool needs to display your Master Password as you type it.  I personally don't want someone who happens to be looking over my shoulder to be able to see my master password, as well as all of the command-line arguments.

Below is a patch that will resolve this issue.

Code: [Select]

Index: cli/trunk/main.cpp
===================================================================
--- cli/trunk/main.cpp  (revision 188)
+++ cli/trunk/main.cpp  (working copy)
@@ -138,7 +138,9 @@
        if (settings.mpw == "\x01") {
                char tmpw[255]; // Hope this is enough for a master password
                cout << "Master Password :";
+               system("stty -echo");
                cin.getline(tmpw, 254);
+               system("stty echo");
                cout << endl;
                settings.mpw = tmpw;
        }


Title: Don't echo Master Password in command-line tool
Post by: Miquel 'Fire' Burns on April 23, 2007, 02:21:36 AM

Windows don't have a stty command.

If you know of a cross platform way to do the same thing, let us know.

Title: Don't echo Master Password in command-line tool
Post by: Eric H. Jung on April 26, 2007, 01:47:56 AM

Is it worth compiling into the non-Windows builds with precompiler directives?

Title: Don't echo Master Password in command-line tool
Post by: Miquel 'Fire' Burns on April 27, 2007, 02:28:30 AM

Good idea. Might do that.

Anyway, a way to do this on Windows would be nice.

Title: Don't echo Master Password in command-line tool
Post by: Eric H. Jung on April 30, 2007, 03:55:10 AM

Quote from: miquelfire

Good idea. Might do that.

Anyway, a way to do this on Windows would be nice.

Found an example:
http://www.codeproject.com/dotnet/ConsolePasswordInput.asp (http://www.codeproject.com/dotnet/ConsolePasswordInput.asp)
Although the author uses .NET, the code he's using to echo asterisks "Windows Console APIs imported to C# via DllImport attributes." In other words, we should be able to rip out the non-.NET stuff pretty easily to get the crux of the solution. I realize echoing asterisks isn't as good as echoing NOTHING, but this solution is better than none...

Title: Re: Don't echo Master Password in command-line tool
Post by: Eric H. Jung on June 01, 2007, 10:32:45 PM

FYI, Miquel fixed this and released it on 22 May. Command-line edition no longer echoes typed passwerds [sic].