Password revealed in terminal after empty password attempt [closed]

Question

In Ubuntu (maybe other distros too) terminals it appears that password echoing gets enabled between failed password prompts revealing whatever is being typed (the password most probable).

I encountered this issue where my password became visible in plaintext on the terminal when hitting enter by accident before starting typing the password.

Steps to Reproduce:

1. Execute a command that requires a password e.g. sudo ls.
2. When prompted for the password, hit Enter before typing anything, then immediately start typing the password.
3. While the system validates the empty password, the keyboard input becomes visible revealing your password.
4. By the time you hit enter again the system already rejected the empty password and successfully validates the new one leading to a correct execution.

Expected Behavior:

When prompted for password the system should disable input echoing until the password is correctly validated, all the attempts have failed, or the operation has been canceled.

Answer 1

When prompted for the password, hit Enter before typing anything, then immediately start typing the password

This is the cause of the issue. You entered nothing (i.e. a blank password) for the prompt. The system had disabled echo to receive your input, but as soon as it had accepted your input it then re-enabled echo. During the delay while it went off to check your password was wrong you typed your password in again. Echoing had been re-enabled so the text typeahead was echoed to the screen.

It's certainly not a feature but I'd hesitate to call it a bug. You could try reporting it upstream though, and for a security issue I'd tend to side with you in that it's unexpected behaviour.

For now the simple answer is not to preempt password prompts