Hide Forgot
Description of problem: Users are useg to entering passwords at login prompts and the like. It would be nice if libpam-fprintd could swallow the input like password prompts do, instead of prominentally displaying the user's password if they type it in. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731382 Additional Information: Also affects rhel-7, fedora-all.
This is a design problem with PAM, worked around by various front-ends (most preeminently gdm, which uses multiple PAM stacks). Given that this risks breaking a number of PAM front-ends, and concern all PAM modules (say, smartcard logins), this should be fixed in PAM if at all.
PAM library on itself does not have any knowledge about the environment it operates in. I don't really see a way how PAM library could mitigate this. I suppose it might be reasonable to workaround it in the login by switching off the TTY echo before calling pam_authenticate. However there would be a possibility of breaking other modules which might potentially ask for additional non-password information which is supposed to be echoed.
Closing... I don't think we want to play any nasty games with ECHO in login(1) to avoid situation when user accidentally enters a password when there is no password prompt. It's unreal wish to be resistant to all possible use-cases and user mistakes. It's user responsibility to be careful with password...