Skip to content

Masked input instead Hidden & more smart_subs addition to Password-Checker.py #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Masked input instead Hidden & more smart_subs addition to Password-Checker.py #46

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 33 additions & 7 deletions Password-Checker/check-password.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
#!/usr/bin/env python
import re
import sys
import random
import re, sys, random, termios, tty
from getpass import getpass

# ANSI escape codes for colors
Expand All @@ -20,7 +18,7 @@
}

COMMON_WORDS = {
'adjectives': ['Happy', 'Clever', 'Swift', 'Brave', 'Bright'],
'adjectives': ['Happy', 'Clever', 'Swift', 'Brave', 'Bright', 'Cool'],
'nouns': ['Tiger', 'River', 'Mountain', 'Storm', 'Star'],
'numbers': ['365', '42', '777', '314', '999'],
'separators': ['_', '.', '#', '*', '@']
Expand All @@ -33,6 +31,33 @@
'special': re.compile(r'[!@#$%^&*(),.?":{}|<>]')
}

def passwd_enter(prompt_part, mask="x"):
prompt = f"\nEnter the Password to {prompt_part}: "
sys.stdout.write(prompt)
sys.stdout.flush()
password = ""
fd = sys.stdin.fileno()
old_settings = termios.tcgetattr(fd)
try:
tty.setraw(fd)
while True:
ch = sys.stdin.read(1)
if ch in ('\r', '\n'):
sys.stdout.write('\r\n')
sys.stdout.flush()
break
elif ch == '\x7f': # backspace
if password:
password = password[:-1]
sys.stdout.write('\b \b')
sys.stdout.flush()
else:
password += ch
sys.stdout.write(mask)
sys.stdout.flush()
finally:
termios.tcsetattr(fd, termios.TCSADRAIN, old_settings)
return password
Comment on lines +34 to +60
Copy link
Contributor

@iamwatchdogs iamwatchdogs Nov 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @LUCKYS1NGHH,

Just review your changes, and they're great. It has improved UX for the end user, but these changes do have some major concerns, like security, cross-platform compatibility and an edge case issue.

I understand you're recommending these changes to make this small project even better, but these changes can't be accepted at the cost of the core intention of this project.

Major Concerns:

  • Security:
    • While the idea of masking sounds more user-friendly, it gives off more details, like password length.
    • Since you're storing the password, it's unsecured and may persist even after execution.
  • Cross-Platform Compatibility:
    • Since you're using termios, it's best suited for *unix-based systems but not Windows.
  • Edge Case:
    • While this logic looks great, this has a major flaw, and that is detecting keystrokes that prompt signals like SIGTERM, i.e., ctrl + c or any other Keyboard Interrupt/EOF.
    • This Edge case goes the same for the systems while using delete on macOS systems when compared to backspace on Windows-based systems.

While some external packages and modules provide such masking while handling all the above-mentioned concerns, I believe keeping the getpass implementation would make sense based on this project's core intention.

This project was meant to be a simple script that uses native functions/methods/packages to address multiple concerns, thus providing high portability where the script executes without any additional requirements.

Also getpass function is battle-tested and takes care of all the above concerns while also addressing many other security concerns that are not mentioned here.


def format_to_header(
msg: str,
Expand Down Expand Up @@ -168,8 +193,9 @@ def suggest_better_password(password):

# Smart character substitutions (maintain readability)
smart_subs = {
'a': '@', 'e': '3', 'i': '!', 'o': '0', 's': '$',
'ate': '8', 'to': '2', 'for': '4'
'a': '@', 'e': '€', 'i': '!', 'o': '0', 's': '$',
'ate': '8', 'to': '2', 'for': '4', 'and': '&',
'b': 'be', 'u': 'you'
}

# Apply substitutions intelligently
Expand Down Expand Up @@ -212,7 +238,7 @@ def input_handler():
print("For enhanced security, your input will be hidden.")
print("Hence, you may not see the characters as you type.")
try:
password = getpass("\nEnter password to check: ")
password = passwd_enter("check")
except KeyboardInterrupt:
print("\nExiting...")
sys.exit(0)
Expand Down