In Ubuntu (maybe other distros too) terminals it appears that password echoing gets enabled between failed password prompts revealing whatever is being typed (the password most probable).
demo GIF
I encountered this issue where my password became visible in plaintext on the terminal when hitting enter by accident before starting typing the password.
Steps to Reproduce:
- Execute a command that requires a password e.g.
sudo ls. - When prompted for the password, hit Enter before typing anything, then immediately start typing the password.
- While the system validates the empty password, the keyboard input becomes visible revealing your password.
- By the time you hit enter again the system already rejected the empty password and successfully validates the new one leading to a correct execution.
Expected Behavior:
When prompted for password the system should disable input echoing until the password is correctly validated, all the attempts have failed, or the operation has been canceled.