Video attached - I can basically see the password after "incorrect password".

[gabriele2000]

To trigger the bug you have to "fail" then quickly type your password... the system will take some seconds to ask the password again, while it's "processing" you'll be able to see your password.
The video attached is inside the .zip

Bug.zip

[millert]

If you type your password before the password prompt is displayed, echo will still be enabled on the terminal and what you type will be visible. The password is read in a loop so echo is disabled/enabled each time. This wasn't a big problem until PAM added a delay between incorrect password entries. Changing things such that echo is disabled a single time is difficult due to how the PAM conversation API works. Other programs that give the user multiple tries to enter a password, such as ssh, behave similarly.

[gabriele2000]

If you type your password before the password prompt is displayed, echo will still be enabled on the terminal and what you type will be visible. The password is read in a loop so echo is disabled/enabled each time. This wasn't a big problem until PAM added a delay between incorrect password entries. Changing things such that echo is disabled a single time is difficult due to how the PAM conversation API works. Other programs that give the user multiple tries to enter a password, such as ssh, behave similarly.

Why isn't this a HUGE security concern? Like, the password is basically visible in this time span.
Why did PAM add this delay though?

[millert]

My understanding is that the delay is to make it more expensive to brute-force password guessing. The password is only visible if you type it before the password prompt is displayed again.

[correabuscar]

I've had my delay set to 0.5sec via /etc/pam.d/system-auth
ie.

auth    optional  pam_faildelay.so delay=500000
...
auth    requisite pam_faillock.so preauth deny=0 nodelay
auth    [success=1 default=ignore]  pam_unix.so   try_first_pass nodelay
auth    [default=die] pam_faillock.so authfail nodelay
...

on Gentoo.

but it used to be a minimum of 2 seconds before, thankfully, this PR got merged 2 years ago https://github.com/linux-pam/linux-pam/pull/296/files#diff-2e96e9a921efffe0106677739e14d3ffe27af0fb7e244bf869866ddad6359023L657