Hide Password when logging in

[p1ho]

Summary

When I logged in, the password is out in the open, it'd be nice if the password stays hidden.

Motivation

Security

[tomquirk]

Hi @p1ho , how do you mean "the password is out in the open"? As you enter the password, it should be hidden. Can you provide a screenshot?

[p1ho]

Yes for sure. I'm running Git Bash on Windows 10 with Node v10.15.3 and npm 6.4.1

[tomquirk]

huh, thats really interesting! It is hidden on MacOS and Linux afaik. We're simply using this library. I'll look into it a bit more though

[p1ho]

I see, I took a look at open issues and there were a couple that could be related:

• 187
• 160

[p1ho]

@tomquirk
So I found the relevant code in the code base and tried to test it in isolation. Interestingly it works again...
This was the test code, the only dependency was prompt

const prompt = require('prompt');

var x = new Promise((resolve, reject) => {
  prompt.get(
      [
        {
          name: "email",
          required: true,
        },
        {
          name: "password",
          required: true,
          hidden: true,
        },
      ],
      (err, result) => {
        if (err) return reject(err);
        return resolve(result);
      },
    );
  }).then(result => {
    console.log(result);
  });

and this was the output

It's also not a version issue, because prompt should still be at version 1.0.0
I wonder if there are other places in the code base that could have messed with it...

UPDATE:
Tried a few things:

• Tried running messer in Powershell, the password hides correctly.
• Went into the directory installed by npm i -g messer and ran node index.js locally, the password is hidden correctly.
• Downloaded a zip of the master branch:
  • using node index.js, the password is hidden correctly.
  • uninstalled messer globally, ran npm link, then ran messer. The password shows up.

I don't know how this could make a difference, but the problem seems to have stemmed from the command aliasing by npm.