Allow password prompts to render a mask of the current input about inquire HOT 4 CLOSED

Case 1:

The current architecture only renders a new frame after a key press. Doing anything time-based would require a big refactor of the library, so I think the blinking solution would not be completely worth it.

Case 2:

Unfortunately, it looks like it is very difficult to receive key press and key release events from a tty, if not impossible (I didn't look far enough). Also, crossterm does not support it, which means that if possible, I'd probably have to talk to them to implement it (or do it myself). Anyway, it also looks like a huge effort for something that can be solved with other alternatives.

Finally, I took your Ctrl+R suggestion and implemented the password display feature by toggling the current "display" mode. If the user presses Ctrl+R, it will display the input as a normal text input. Ctrl+R again and it goes back to nothing being displayed.

Take a look: dfbab54 and let me know what you think.

from inquire.

I think CTRL + R is a great solution for those cases when a new password is created and the user wants to check that there are no typos. Password confirmation is also a good solution, but I agree that it shouldn't be part of the library.

from inquire.

Motivation: Avoid accidental typing errors that will lead to the inability to use a password.

Case 1: If, for some reason, the signal of pressing one or more of the keys is lost (the keystroke was insufficient), the user will not know the entered password. The entered password is different from the password that the user wanted to enter and this can create difficulties.

A possible solution is to provide feedback to the user about the keystroke. A character input event can be displayed by blinking the cursor once or by briefly changing the appearance of the cursor. In general, I am against the possibility of revealing the length of the password. The proposed solution is less in violation of accepted CLI standards and more secure.

Case 2: Accidental key presses next to the pressed key. This will lead to difficulties, as in the previous case.

Possible solution: The user can display the password entered using the keyboard shortcut to verify that the password has been entered correctly. Ideally, there should be a user pressing and holding a specific keyboard shortcut (maybe Ctrl + R? R as reveal, easier to remember). The password should be hidden as soon as the keys are released. It may not be easy to implement, because a tty doesn't know about the concept of key press or key release events. It only knows about 'data stream in' (and out). The proposed solution does not conflict with CLI standards.

So, you can provide the user more options to control and avoid typing errors.

from inquire.

I have also decided to implement this feature as an optional customization for library users, recommending them to not do anything special and follow standard CLI applications :)

Please let me know if using the default display mode (hidden) and allowing the toggling of display mode satisfy your needs of both security, by not revealing any info by default, and convenience, by allowing you to see the current input, just not on key press/release but by pressing the twice the shortcut. For example:

    let passwd = Password::new("Password:")
        .with_display_toggle_enabled()
        .with_display_mode(PasswordDisplayMode::Hidden) // default value but mentioned here to make it explicit
        .with_validator(min_length!(10))
        .with_formatter(&|_| String::from("Password received"))
        .with_help_message("It is recommended to generate a new one only for this purpose")
        .prompt()?;
   
    let confirmation = Password::new("Confirmation:")
        .with_display_toggle_enabled()
        .with_display_mode(PasswordDisplayMode::Hidden) // default value but mentioned here to make it explicit
        .with_formatter(&|_| String::from("Confirmation received"))
        .with_help_message("It is recommended to generate a new one only for this purpose")
        .prompt()?;
    
    if password == confirmation {
        Ok(password)
    } else {
        Err(())
    }

from inquire.