Echo '*' chars instead of what's typed

[bad_knee]

Hello,
I'm getting password input from the user in a perl script,
and was wondering if anyone knows how to echo splats at them
instead of not showing any chars at all? (eg: stty -echo)

Thanks

 

[Ben Morrow]

Hello,
I'm getting password input from the user in a perl script,
and was wondering if anyone knows how to echo splats at them
instead of not showing any chars at all? (eg: stty -echo)

perldoc -q password

Ben

 

[Ben Morrow]

perldoc -q password

Sorry, the 'stty -echo' put me off, and I assumed you were asking how
to not echo...

I guess what you want to do is read one char at a time, either using
read or by setting $/ = \1, and print the *s yourself. Note that you
will probably have to put the terminal into cbreak mode and handle
delete/backspace/etc yourself, which is probably why most Unix
commands simply don't echo passwords... (There is also a slight
security advantage: with *s, someone peering over your shoulder sees
how long the password is.)

Ben

 

[Greg Bacon]

: I'm getting password input from the user in a perl script,
: and was wondering if anyone knows how to echo splats at them
: instead of not showing any chars at all? (eg: stty -echo)

Borrowing from tchrist's <[email protected]>:

% cat try
#! /usr/local/bin/perl

use warnings;
use strict;

use IO::Handle;
use POSIX qwtermios_h);

sub termattr {
my $fh = shift;
my $fd = fileno $fh;

my $term = POSIX::Termios->new();
$term->getattr($fd);

my $oterm = $term->getlflag();

{
fd => $fd,
term => $term,
oterm => $oterm,
noecho => $oterm & ~(ECHO | ECHOK | ICANON),
};
}

sub cbreak {
my $attr = shift;
my $term = $attr->{term};

$term->setlflag($attr->{noecho}); # ok, so i don't want echo either
$term->setcc(VTIME, 1);
$term->setattr($attr->{fd}, TCSANOW);
}

sub cooked {
my $attr = shift;
my $term = $attr->{term};

$term->setlflag($attr->{oterm});
$term->setcc(VTIME, 0);
$term->setattr($attr->{fd}, TCSANOW);
}

sub done {
my $attr = shift;
cooked $attr;
}

package main;

sub ask_for_pw {
print "Enter password: ";
STDOUT->flush;

my $attr = termattr \*STDIN;
cbreak $attr;

my $passwd;
my $ch;
while (defined sysread STDIN, $ch, 1) {
last if $ch eq "\n";

print "*";
STDOUT->flush;

$passwd .= $ch;
}

done $attr;
print "\n";

$passwd;
}

my $pw = ask_for_pw;
print "The password is '$pw'\n";
% ./try
Enter password: ******************
The password is 'theycallhimflipper'

Hope this helps,
Greg

 

[Chris Mattern]

Hello,
I'm getting password input from the user in a perl script,
and was wondering if anyone knows how to echo splats at them
instead of not showing any chars at all? (eg: stty -echo)

Why tell potetial shoulder surfers how long the password is?
That's valuable information.

Chris Mattern

 

[bad_knee]

Why tell potetial shoulder surfers how long the password is?
That's valuable information.

Chris Mattern

Your assuming too much.

 

[bad_knee]

Sorry, the 'stty -echo' put me off, and I assumed you were asking how
to not echo...

I guess what you want to do is read one char at a time, either using
read or by setting $/ = \1, and print the *s yourself. Note that you
will probably have to put the terminal into cbreak mode and handle
delete/backspace/etc yourself, which is probably why most Unix
commands simply don't echo passwords... (There is also a slight
security advantage: with *s, someone peering over your shoulder sees
how long the password is.)

Ben

Thanks for the input.

 

[bad_knee]

: I'm getting password input from the user in a perl script,
: and was wondering if anyone knows how to echo splats at them
: instead of not showing any chars at all? (eg: stty -echo)

Borrowing from tchrist's <[email protected]>:

% cat try
#! /usr/local/bin/perl

<snip>
my $template = "****";
my $str = "";
print substr($template, 1, int((rand(length($template)))));

# print "*";
STDOUT->flush;

$passwd .= $ch;
}

Hope this helps,
Greg

Excellent. Thanks Greg, this is perfect.
I added a "random splat printer" for those that
asked how to do it.

Thanks for the help!

 

[Greg Bacon]

: my $template = "****";
: my $str = "";
: print substr($template, 1, int((rand(length($template)))));

If you want Lisp, you know where to find it. Perl's list operator
parsing can really reduce the fingernail clippings:

my $template = "****";
print substr $template, 1, rand length $template;

Assuming you want from one, two, three, or four splats, you should say

print substr $template, 0, rand(length $template) + 1;

: [...]
: Thanks for the help!

You're welcome.

Greg

 

[Andrew DeFaria]

perldoc -q password

I'm on Mandrake 9.1:

$ erldoc -q password
-bash: perldoc: command not found

OK where do I get perldoc?

 

[Tad McClellan]

OK where do I get perldoc?

It is installed along with perl itself.

If you have a properly installed perl, then you already have it.

Looks like wherever it got installed is not in your path...

 

[Ben Morrow]

-=-=-=-=-=-
[Alternative: text/html]
-=-=-=-=-=-

DON'T do that.

The perl is the perl that was installed when I installed Mandrake 9.1.


Looks like perldoc isn't installed:

<snip rpmage>

Then you will need to ask a Mandrake group/list how to install it. A
proper install of perl will always include perldoc: I would have
thought it would have been in perl-{,base-,devel-}5.8.0-17mdk, but it
seems Mandrake in their infinite wisdom have put it somewhere else.

Ben

 

[Chris Mattern]

-=-=-=-=-=-
[Alternative: text/html]
-=-=-=-=-=-

DON'T do that.

The perl is the perl that was installed when I installed Mandrake 9.1.



Looks like perldoc isn't installed:

<snip rpmage>

Then you will need to ask a Mandrake group/list how to install it. A
proper install of perl will always include perldoc: I would have
thought it would have been in perl-{,base-,devel-}5.8.0-17mdk, but it
seems Mandrake in their infinite wisdom have put it somewhere else.

Personally, I would regard that as broken, and bitch at Mandrake about
it.

Chris Mattern