Masked password characters in a GUI vs terminal

Question

In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password.

But in terminal applications, for example ssh, this is rare - it's usual just for the terminal to have echo off as the user inputs password.

Why this discrepancy? I'm of the opinion that the echo is just as useful on a tty as it is on a GUI. It gives you some visual feedback to your actions so you know the input is going somewhere, and if you accidentally bumped two keys you can notice it immediately and backspace appropriately.

Answer 1

I would say this post offers a good rational as to why many/most command line programs don't echo.

To summarize, it is normally much easier to disable echo, than replace the text, with command line programs.

Answer 2

Part of the commonly held belief by technical people is that not having an echo of * makes the password more secure as anyone watching over your shoulder is not aware of the password length - which they would be if they saw the number of * characters.

So whether or not the original reasoning were security, the fact that most users perceive not having an echo as a security benefit means that changing it is likely to be seen in a negative light by users, and would probably then be poor UX.

That aside, it's significantly simpler to disable the echo than it is to modify it to return a different character than the one that was entered. This very likely plays a role in why it isn't done, but has little to do with UX.

The user perception is the key here, and a perceived benefit is as good as a real benefit - especially when it comes to security.