Leaking secret through Password validation message

[AuHau]

Today I realized that when you use Password question and supply invalid value, the entered value is prompted in plaintext in the error message.

I believe that this should not be the correct behavior as it could resolve in accidental leaking the secret to the surrounding (in a sense, somebody watching over my shoulder).

I would inspire regarding how to approach this from well-established utilities like sudo, which does not even print any chars to prevent from leaking the length of the secret.

I could do PR to fix this.

[magmax]

not printing any character is a bad idea, because some users think that they wrote nothing. But Inquirer is here to try to think in any option, so setting an empty character should be allowed.

I will take a look on this issue.

Thank you for reporting!

[AuHau]

Well since Inquirer is focused on CLI environment, some level of user's knowledge could be assumed (and hence knowledge how CLI tools handle entering secrets). But on other hands, the current behavior is common in the web environment, so I guess it is alright to print starts.

But I would be quiet careful about printing the secret in validation messages as reported earlier...

[AuHau]

@magmax any update? I could do PR for the validation message not printing the entered value, would that be acceptable for you?

[magmax]

This should fix it. Try the example/password.py file.

[AuHau]

Hmm, I think you tackled bit different problem. I also mentioned it here, but it was not the more important one ;-) I was more referencing on leaking secrets through the validation messages eq. "'my super secret password' is not valid password".
I have created PR to show you, what I have in mind ;-)

[AuHau]

Fixed with #53.