Author Topic: Don't echo Master Password in command-line tool  (Read 8665 times)

Offline lewk

  • Normal Members
  • *
  • Posts: 1
Don't echo Master Password in command-line tool
« on: April 22, 2007, 08:56:15 AM »
This has probably been brought up before, but I don't know of any reason why the command-line tool needs to display your Master Password as you type it.  I personally don't want someone who happens to be looking over my shoulder to be able to see my master password, as well as all of the command-line arguments.

Below is a patch that will resolve this issue.

Code: [Select]
Index: cli/trunk/main.cpp
===================================================================
--- cli/trunk/main.cpp  (revision 188)
+++ cli/trunk/main.cpp  (working copy)
@@ -138,7 +138,9 @@
        if (settings.mpw == "\x01") {
                char tmpw[255]; // Hope this is enough for a master password
                cout << "Master Password :";
+               system("stty -echo");
                cin.getline(tmpw, 254);
+               system("stty echo");
                cout << endl;
                settings.mpw = tmpw;
        }

Offline Miquel 'Fire' Burns

  • Administrator
  • *****
  • Posts: 1157
  • Programmer
Don't echo Master Password in command-line tool
« Reply #1 on: April 23, 2007, 02:21:36 AM »
Windows don't have a stty command.

If you know of a cross platform way to do the same thing, let us know.
« Last Edit: April 23, 2007, 02:21:58 AM by miquelfire »
"I'm not drunk, just sleep deprived."

Offline Eric H. Jung

  • grimholtz
  • Administrator
  • *****
  • Posts: 3353
Don't echo Master Password in command-line tool
« Reply #2 on: April 26, 2007, 01:47:56 AM »
Is it worth compiling into the non-Windows builds with precompiler directives?

Offline Miquel 'Fire' Burns

  • Administrator
  • *****
  • Posts: 1157
  • Programmer
Don't echo Master Password in command-line tool
« Reply #3 on: April 27, 2007, 02:28:30 AM »
Good idea. Might do that.

Anyway, a way to do this on Windows would be nice.
"I'm not drunk, just sleep deprived."

Offline Eric H. Jung

  • grimholtz
  • Administrator
  • *****
  • Posts: 3353
Don't echo Master Password in command-line tool
« Reply #4 on: April 30, 2007, 03:55:10 AM »
Quote from: miquelfire
Good idea. Might do that.

Anyway, a way to do this on Windows would be nice.

Found an example:
http://www.codeproject.com/dotnet/ConsolePasswordInput.asp
Although the author uses .NET, the code he's using to echo asterisks "Windows Console APIs imported to C# via DllImport attributes." In other words, we should be able to rip out the non-.NET stuff pretty easily to get the crux of the solution. I realize echoing asterisks isn't as good as echoing NOTHING, but this solution is better than none...

Offline Eric H. Jung

  • grimholtz
  • Administrator
  • *****
  • Posts: 3353
Re: Don't echo Master Password in command-line tool
« Reply #5 on: June 01, 2007, 10:32:45 PM »
FYI, Miquel fixed this and released it on 22 May. Command-line edition no longer echoes typed passwerds [sic].

PasswordMaker Forums

Re: Don't echo Master Password in command-line tool
« Reply #5 on: June 01, 2007, 10:32:45 PM »