Masking Password Entries in Xcode C++

[donttrackme]

I'm making a Project on a Travel Agency and I need to hide the password entered by the user! I am working on Xcode 5.1.1 -> Command Line Tools -> C++ on my MacBook Pro! Here is what I've tried --

 string pass ="";
    char ch;
    cout << "Enter pass\n";
    ch = getchar();
    while(ch != 13){//character 13 is enter
        pass.push_back(ch);
        cout << '*';
        ch = getchar();
    }

AND

 string pass ="";
    char ch;
    cout << "Enter pass\n";
    ch = getch();
    while(ch != 13){//character 13 is enter
        pass.push_back(ch);
        cout << '*';
        ch = getch();
    }

But in the first case the display is -
//Assuming the password is Hello
Hello
******

And in the second its giving me 3 errors -

1. Apple Mach-O Linker(Id) Error
"_stdscr", referenced from:

2. Apple Mach-O Linker(Id) Error
"_wgetch", referenced from:

3. Apple Mach-O Linker(Id) Error
clang: error: linker command failed with exit code 1 (use -v to see invocation)

PLEASE HELP ASAP :D Project due on Friday and i'm still on the login page!!!

[Little Bobby Tables]

you need unbuffered input for mac. you can get this via ncurses, of course if it only has to be on mac then there might be a platform specific solution. i have a variation of unbuffered input, but it requires ncurses (the advantage though is that you dont have to create a window to use it)

[JLBorges]

#include <string>
#include <pwd.h>
#include <unistd.h>
#include <algorithm>

int main()
{
    bool valid_password = false ;
    
    // http://www.freebsd.org/cgi/man.cgi?query=getpass&manpath=FreeBSD+9.3-RELEASE&arch=default&format=html
    char* pword_buffer = getpass( "enter password:" ) ;

    {
        const std::string passwd = pword_buffer ; // copy password to string
        std::fill( pword_buffer, pword_buffer + _PASSWORD_LEN, ' ' ) ; // clear password in system buffer

        // validate password; if valid set valid_password to true

        std::fill( passwd.begin(), passwd.end(), ' ' ) ; // clear password in string
    } 

    if( valid_password ) // ...

}

[Little Bobby Tables]

http://stackoverflow.com/questions/1196418/getting-a-password-in-c-without-using-getpass-3

[donttrackme]

Little Bobby Tales - in the method you suggested ( the method on stackoverflow.com) the password is still being shown! It's not disabling echo!! :(

JLBorges - In the method you suggested the error just says -
! Algorithm

Additionally i tried the noecho(); function in the curses lib along with both cin>>string; and ch=getchar(); but it gave this error -
Apple Mach-O Linker(Id) Error
"_noecho", referenced from:

[Duthomhas]

You need to link with -lncurses (or -lcurses, IDK which on a Mac).
Don't use getpass().

[Little Bobby Tables]

sid poduval, that was directed at jlborges, showing not to use getpass

[JLBorges]

> JLBorges - In the method you suggested the error just says -
> ! Algorithm

#include <algorithm>

And remove the const from (we want to clear the pass word from memory as soon as possible):

// const std::string passwd = pword_buffer ; // copy password to string
std::string passwd = pword_buffer ; // copy password to string  

#include <string>
#include <pwd.h>
#include <unistd.h>
#include <algorithm>

int main()
{
    bool valid_password = false ;
    
    // http://www.freebsd.org/cgi/man.cgi?query=getpass&manpath=FreeBSD+9.3-RELEASE&arch=default&format=html
    char* pword_buffer = getpass( "enter password:" ) ;

    {
        std::string passwd = pword_buffer ; // copy password to string
        const std::size_t max_pword_len = 128 ;
        std::fill( pword_buffer, pword_buffer + max_pword_len, ' ' ) ; // clear password in system buffer

        // validate password; if valid set valid_password to true

        std::fill( passwd.begin(), passwd.end(), ' ' ) ; // clear password in string
    } 

    if( valid_password ) // ...

}

[Little Bobby Tables]

except instead of using getpass, you should probably use a solution from here: http://www.cplusplus.com/articles/E6vU7k9E/ since getpass is deprecated

[donttrackme]

JLBorges it is still not hiding the password! If you can give me your email id i'll send you the screen shots!

I directly copied the given code in a new program and added the if ( valid_password ) checks and ran the program...

[JLBorges]

As per the OSX documentation, it getpass() should work as expected.
https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man3/getpass.3.html

Are you running the program from the command line?

Another option is to use readpassphrase() (BSD extension, non-portable)
https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man3/readpassphrase.3.html#//apple_ref/doc/man/3/readpassphrase